Cisco Product Security Update Advisory

Overview

 

Cisco has released security updates that address vulnerabilities in Cisco products. Users of affected products are advised to update to the latest version.
 

 

Affected Products

 

CVE-2025-20281

 

Cisco ISE Version: 3.3
Cisco ISE Version: 3.4
Cisco ISE-PIC Version: 3.3
Cisco ISE-PIC Version: 3.4

 

CVE-2025-20282

 

Cisco ISE Version: 3.4
Cisco ISE-PIC Version: 3.4

 

 

Resolved Vulnerabilities

 

Arbitrary code execution vulnerability in certain APIs in Cisco ISE and Cisco ISE-PIC (CVE-2025-20281)
Arbitrary code execution vulnerability after arbitrary file upload in certain APIs in Cisco ISE and Cisco ISE-PIC (CVE-2025-20282)

 

 

Vulnerability Patches

Vulnerability Patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.

 

CVE-2025-20281

 

Cisco ISE Version: 3.3 Patch 6 ise-apply-CSCwo99449_3.3.0.430_patch4-SPA
Cisco ISE-PIC Version: 3.3 Patch 6 ise-apply-CSCwo99449_3.3.0.430_patch4-SPA
Cisco ISE Version: 3.4 Patch 2 ise-apply-CSCwo99449_3.4.0.608_patch1-SPA
Cisco ISE-PIC Version: 3.4 Patch 2 ise-apply-CSCwo99449_3.4.0.608_patch1-SPA

 

CVE-2025-20282

 

Cisco ISE Version: 3.4 Patch 2 ise-apply-CSCwo99449_3.4.0.608_patch1-SPA
Cisco ISE-PIC Version: 3.4 Patch 2 ise-apply-CSCwo99449_3.4.0.608_patch1-SPA

 

 

References

 

[1] Mozilla Foundation Security Advisory 2025-47
https://www.mozilla.org/en-US/security/advisories/mfsa2025-47/