- Cisco releases fix for two defects in Identity Services Engine
- The deficiencies allowed to perform external code, sensitive data exfiltration and more
- The first pure version of the Identity Services -Motor is 3.4
Cisco has released patches for two vulnerabilities to critical difficulty that plagues its Identity Services Engine (ISE) solution. As the deficiencies can be abused to run arbitrary commands and steal sensitive information, Cisco called on its users to use the corrections as soon as possible.
In a security advice, the network giant said first that it patched a “Deserialization of user-delivered Java Byte Streams” vulnerability traced as CVE-2025-20124, and got a severity of 9.9/10 (critical). By sending a custom serialized Java object to an affected Cisco ise API, an attacker could perform arbitrary commands and raise privileges.
The second error is an approval city pass error that occurs as an API did not perform authorization control or properly validated user-delivered data. A threat actor could send a malicious http request to API on the device to trigger it. This error is traced as CVE-2025-20125 and got a severity of 9.1/10 (critical).
Authorization required
While these deficiencies sound dangerous, they are not so easy to exploit. Cisco said threat actors still had to be approved and with a Read-Only Admin account at the time.
This means that pulling the attack is much more difficult but still not impossible. Seam Registered Properly noticed Cyber Criminal Phish for Login Legitimation Information or simply buy them from the Black Market.
“It is worth noting that NCC Group accused last year’s increase in ransomware -attack partially on compromised credentials, so it’s not like these are too difficult to get. Of course, Rogue Insiders can also abuse these holes, ”the publication said.
In any case, Cisco has already come out with corrections, so it should be done to patch them as soon as possible. Versions 3.0 – 3.3 are said to be vulnerable, so users need to make sure they bring their software to version 3.4, at least. The good news is that there is still no evidence of abuse in nature.
Via Registered
