CVE-2025-20343
highPriorität · verfolgen · 40EPSS 0.007 · 53. PerzentilExploit · PoCDEEUNLRUUSEPSS · bewertet 2026-10-27
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenCisco Identity Services Engine Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco Identity Services Engine Softwarecisco_csaf
Cisco ISE devices are affected by this vulnerability only if Reject RADIUS requests from clients with repeated failures is configured. As a workaround, administrators can disable this setting using the following steps: Choose Administration > System > Settings > Protocols > RADIUS. Navigate to the Suppress Repeated Failed Clients and repeated accounting section. Uncheck only the Reject RADIUS requests from clients with repeated failures check box. This setting is enabled by default and will be configured in most environments. If this configuration setting is disabled, the Cisco ISE device is not affected by this vulnerability. However, Cisco recommends re-enabling this configuration setting once the device has been upgraded to the fixed code. For more information on this feature, which is new in Cisco ISE Release 3.4.0, see RADIUS Settings ["https://www.cisco.com/c/en/us/td/docs/security/ise/3-4/admin_guide/b_ise_admin_3_4/b_ISE_admin_segmentation.html#t_security_settings_33"] in the Cisco Identity Services Engine Administrator Guide, Release 3.4. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (1)
Öffentlicher Proof-of-Concept- und Exploit-Code.
betroffene Produkte (11)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2025-0354Kwetsbaarheid verholpen in Cisco Identity Services EngineNL2025-11-06csaf · ncsc_nlNL
Cisco heeft een kwetsbaarheid verholpen in Cisco Identity Services Engine.
- WID-SEC-W-2025-2492Cisco Identity Services Engine (ISE): Schwachstelle ermöglicht Denial of ServiceDeutsch2025-11-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Identity Services Engine (ISE) ausnutzen, um einen Denial of Service Angriff durchzuführen.
- cisco-sa-ise-radsupress-dos-8YF3JThhCisco Identity Services Engine RADIUS Suppression Denial of Service Vulnerability2025-11-05csaf · cisco_csafUS
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (4)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2025-20343cnnvd
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThhcnnvd
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThhenisa_euvd
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThhVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan