{"id":11411,"date":"2025-07-29T12:14:02","date_gmt":"2025-07-29T05:14:02","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=11411"},"modified":"2026-06-25T09:58:31","modified_gmt":"2026-06-25T02:58:31","slug":"warn-about-vulnerabilities-in-cisco-ise-that-allow-hackers-to-remotely-hijack-the-system","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/en\/2025\/07\/29\/warn-about-vulnerabilities-in-cisco-ise-that-allow-hackers-to-remotely-hijack-the-system\/","title":{"rendered":"Warn about vulnerabilities in Cisco ISE that allow hackers to remotely hijack the system"},"content":{"rendered":"<div style=\"text-align: justify\"><b>Security experts have recently released details of an attack technique that hijacks the Cisco ISE system through the security flaw CVE-2025 &#8211; 20281, a serious error that allows remote attackers to execute commands with root permissions.<\/b><br \/>\n\u200b<\/div>\n<div style=\"text-align: center\"><a class=\"js-lbImage\" style=\"cursor: pointer\" href=\"https:\/\/whitehat.vn\/attachments\/1753771954826-png.17380\/\" target=\"_blank\" rel=\"noopener\" data-caption=\"&lt;h4&gt;1753771954826.png&lt;\/h4&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;whitehat.vn&amp;#x2F;threads&amp;#x2F;canh-bao-lo-hong-trong-cisco-ise-cho-phep-hacker-chiem-quyen-he-thong-tu-xa.18609&amp;#x2F;#post-44118&quot; class=&quot;js-lightboxCloser&quot;&gt;WhiteHat Team \u00b7 29&amp;#x2F;07&amp;#x2F;2025 l\u00fac 1:55 PM&lt;\/a&gt;&lt;\/p&gt;\" data-fancybox=\"lb-thread-18609\" data-lb-caption-extra-html=\"\" data-lb-sidebar-href=\"\"><img fetchpriority=\"high\" decoding=\"async\" class=\"bbImage\" title=\"1753771954826.png\" src=\"https:\/\/whitehat.vn\/data\/attachments\/17\/17715-0c2cb7c2f83a8b11002174a8837ed490.jpg\" alt=\"1753771954826.png\" width=\"712\" height=\"400\" \/><\/a>\u200b<\/div>\n<div style=\"text-align: justify\">\n<p>The CVE &#8211; 2025-20281 vulnerability is within the Cisco Identity Services Engine (ISE) system, a network access management platform widely used in businesses. Although the vulnerability was warned by Cisco in late June and a patch was released, the details of the exploit were &#8220;warning bells&#8221; for systems that had not yet been updated.<\/p>\n<p>Two related security vulnerabilities exist:<\/p>\n<\/div>\n<ul>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">CVE &#8211; 2025-20281: Command injection error allowing the attacker to send special data, which in turn executes the system command.<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">CVE-2025 &#8211; 20337: An unsafe deserialization error, making the data processing software unsafe, paving the way for malicious code to enter.<\/div>\n<\/li>\n<\/ul>\n<div style=\"text-align: justify\">\n<p>The only thing that&#8217;s particularly dangerous is that the hacker doesn&#8217;t need an account or authentication at all, just having access to the system can upload the malicious file and execute it with root access.<\/p>\n<p>In the attack process publication, experts described a complete attack sequence:<\/p>\n<\/div>\n<ol>\n<li data-xf-list-type=\"ol\">\n<div style=\"text-align: justify\">Send a serialized Java payload to take advantage of the deserialization error.<\/div>\n<\/li>\n<li data-xf-list-type=\"ol\">\n<div style=\"text-align: justify\">Enable commands via the Java Runtime.exec() function.<\/div>\n<\/li>\n<li data-xf-list-type=\"ol\">\n<div style=\"text-align: justify\">Use ${IFS} (special character instead of whitespace) to bypass arguments formatting errors when running commands.<\/div>\n<\/li>\n<li data-xf-list-type=\"ol\">\n<div style=\"text-align: justify\">From there, gain root access in the Docker container running the Cisco ISE.<\/div>\n<\/li>\n<li data-xf-list-type=\"ol\">\n<div style=\"text-align: justify\">Then use a common escape technique based on cgroups and release agent to escape Docker and gain root access on the physical server system.<\/div>\n<\/li>\n<\/ol>\n<div style=\"text-align: justify\">\n<p>While the article does not provide any existing mining script, all the techniques and payloads are sufficient to enable the skilled hacker to rebuild the attack engine on his own.<\/p>\n<p>Cisco has confirmed both breaches are being exploited in real life. They influenced versions of ISE 3.3 and 3.4 (both ISe-PIC). From corporate network systems, government organizations to service providers, all run the risk if not updated.<\/p>\n<p>With the CVE &#8211; 2025-20281 vulnerability in Cisco ISE, hackers need not send fraudulent emails, no login accounts, no user interaction. This is a vulnerability on the network service where hackers can send data directly from a distance to the system that is opening the ISE service portal.<\/p>\n<p>When a Cisco ISE system has a vulnerability and the patch has not been updated, hackers can perform attacks in the following sequence:<\/p>\n<p><b>Step 1: Send &#8220;trapping&#8221; data to the system<\/b>\u200b<\/p>\n<\/div>\n<ul>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">The attacker sends a special piece of data (called a payload) to the Cisco ISE. This data is &#8220;packaged&#8221; in such a way that the system will erroneously treat it as valid.<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">While the data is legitimate, the system opens and executes itself (this is called deserialization and injection).<\/div>\n<\/li>\n<\/ul>\n<div style=\"text-align: justify\"><b>Step 2<\/b>: <b>Execute malicious commands with root privileges<\/b>\u200b<\/div>\n<ul>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Through that data, hackers insert system commands into servers running ISE and these commands are run with root access (i.e., top &#8211; of &#8211; the &#8211; system access).<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">With root access, hackers can do anything: install software, modify system files, add hidden accounts, etc..<\/div>\n<\/li>\n<\/ul>\n<div style=\"text-align: justify\"><b>Step 3: Exit Docker, go deeper<\/b><br \/>\nCisco ISE typically runs inside a protected environment called a Docker container. But hackers don&#8217;t stop there. They use an advanced technique to exit Docker and reach the host machine that controls the entire server.<b>Step 4: Permission and control of the entire internal network<\/b>\u200b<\/p>\n<\/div>\n<ul>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">After escaping the protective layer, the hacker may:<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Install spyware or malicious code at your disposal.<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Get login information for employees, systems, and devices.<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Monitoring or recording network activity, forging users.<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Extension of attack to other systems in the same internal network (lateral movement).<\/div>\n<\/li>\n<\/ul>\n<div style=\"text-align: justify\">\n<p>In other words, from a small error in the way the data is processed, hackers can sneak into the system, break through the layers of protection, and eventually take control of the entire network infrastructure like a real administrator.<\/p>\n<p>There is no workaround. The only solution is to update to the latest patches:<\/p>\n<\/div>\n<ul>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">ISE 3.3 Patch 7<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">ISE 3.4 Update to Patch 2<\/div>\n<\/li>\n<\/ul>\n<div style=\"text-align: justify\">In addition, system administrators should:<\/div>\n<ul>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Check for unusual access in the system logs.<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Monitor Docker container operations and high-level process.<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Restrict external access to the ISE if not absolutely necessary.<\/div>\n<\/li>\n<\/ul>\n<div style=\"text-align: justify\">\n<p>The CVE &#8211; 2025-20281 vulnerability in Cisco ISE is a good example of how hackers can exploit weaknesses in corporate network systems to take full control. The fact that a researcher publicly detailed the attack technique further increased the risk of exploitation.<\/p>\n<p>Don&#8217;t wait for an incident to occur. Check your Cisco ISE system immediately and apply the patch as soon as possible. In the online world, one beat down is a sec at the expense of the entire system.<\/p>\n<\/div>\n<div style=\"text-align: right\"><b><i>According to Bleeping Computer<\/i><\/b>\u200b<\/div>\n<div style=\"text-align: right;margin-top: 16px\"><i>Theo: <a href=\"https:\/\/whitehat.vn\/threads\/canh-bao-lo-hong-trong-cisco-ise-cho-phep-hacker-chiem-quyen-he-thong-tu-xa.18609\/\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/whitehat.vn\/threads\/canh-bao-lo-hong-trong-cisco-ise-cho-phep-hacker-chiem-quyen-he-thong-tu-xa.18609\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Security experts have recently released details of an attack technique that hijacks the Cisco ISE system through the security flaw CVE-2025 &#8211; 20281, a serious error that allows remote attackers to execute commands with root permissions. \u200b \u200b The CVE &#8211; 2025-20281 vulnerability is within the Cisco Identity Services Engine (ISE) system, a network access [&hellip;]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[351],"tags":[],"class_list":["post-11411","post","type-post","status-publish","format-standard","hentry","category-news-announcements"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/11411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=11411"}],"version-history":[{"count":2,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/11411\/revisions"}],"predecessor-version":[{"id":11643,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/11411\/revisions\/11643"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=11411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=11411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=11411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}