CVE-2025-20343
highpriority · track · 40EPSS 0.007 · 53 %ileexploit · PoCDEEUNLRUUSEPSS · scored 2026-10-27
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedCisco Identity Services Engine Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco Identity Services Engine Softwarecisco_csaf
Cisco ISE devices are affected by this vulnerability only if Reject RADIUS requests from clients with repeated failures is configured. As a workaround, administrators can disable this setting using the following steps: Choose Administration > System > Settings > Protocols > RADIUS. Navigate to the Suppress Repeated Failed Clients and repeated accounting section. Uncheck only the Reject RADIUS requests from clients with repeated failures check box. This setting is enabled by default and will be configured in most environments. If this configuration setting is disabled, the Cisco ISE device is not affected by this vulnerability. However, Cisco recommends re-enabling this configuration setting once the device has been upgraded to the fixed code. For more information on this feature, which is new in Cisco ISE Release 3.4.0, see RADIUS Settings ["https://www.cisco.com/c/en/us/td/docs/security/ise/3-4/admin_guide/b_ise_admin_3_4/b_ISE_admin_segmentation.html#t_security_settings_33"] in the Cisco Identity Services Engine Administrator Guide, Release 3.4. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (11)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0354Kwetsbaarheid verholpen in Cisco Identity Services EngineNL2025-11-06csaf · ncsc_nlNL
Cisco heeft een kwetsbaarheid verholpen in Cisco Identity Services Engine.
- WID-SEC-W-2025-2492Cisco Identity Services Engine (ISE): Schwachstelle ermöglicht Denial of ServiceDeutsch2025-11-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Identity Services Engine (ISE) ausnutzen, um einen Denial of Service Angriff durchzuführen.
- cisco-sa-ise-radsupress-dos-8YF3JThhCisco Identity Services Engine RADIUS Suppression Denial of Service Vulnerability2025-11-05csaf · cisco_csafUS
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-20343cnnvd
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThhcnnvd
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThhenisa_euvd
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThhVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan