Home Innovation Cisco Cisco Patches Critical Flaws i...

Cisco Patches Critical Flaws in ISE, Intelligence Center

Cisco

Business Honor
23 May, 2025

Cisco urges prompt updates after patching multiple high-risk vulnerabilities in ISE and Intelligence Center systems.

Cisco released 10 new security advisories this week, patching more than a dozen vulnerabilities in a broad set of its products, including high-risk vulnerabilities in its Identity Services Engine (ISE) and Unified Intelligence Center.

Among the most concerning vulnerabilities is one that affects the RADIUS message processing module in Cisco ISE and is designated as CVE-2025-20152. This vulnerability can be used remotely and without authentication to initiate a denial-of-service (DoS) state. Cisco has verified that this problem occurs due to incorrect handling of certain RADIUS authentication requests. An attacker, if used, could compel Cisco ISE to reload by delivering an unauthorized authentication request to a network access device based on ISE for AAA (Authentication, Authorization, and Accounting) services.

Another severity-high vulnerability, CVE-2025-20113, affects the Unified Intelligence Center. It permits an authenticated user to escalate privileges to administrator-level for specific functions. Cisco holds this issue responsible for a lack of server-side validation of user-provided parameters within API and HTTP requests.

A comparable medium-severity vulnerability, CVE-2025-20114, permits horizontal privilege escalation via insecure direct object reference (IDOR) attacks, as a result of identical insufficient validation within API requests.

Apart from the above-mentioned critical vulnerabilities, Cisco also fixed a number of medium-severity vulnerabilities in solutions such as Webex, Secure Network Analytics, Duo, Unified Communications, and Contact Center. These vulnerabilities could cause cross-site scripting (XSS), arbitrary command execution, API misuse, and data tampering.

Cisco highlighted that it has not seen exploitation of any of these vulnerabilities in the wild. Users are advised to install the required patches as soon as possible.