CVE-2025-20305: cisco cisco identity services engine software

Vulnerability summary

CVE-2025-20305 is a medium (CVSS 4.9) vulnerability in cisco cisco identity services engine software. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.8% of scored vulnerabilities.

Timeline

1. 05-11-2025
   PublishedVulnerability first disclosed.
2. 04-12-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because certain files lack proper data protection mechanisms. An attacker with read-only Administrator privileges could exploit this vulnerability by performing actions where the results should only be viewable to a high-privileged user. A successful exploit could allow the attacker to view passwords that are normally not visible to read-only administrators.

• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.