CVE-2025-20131 Details
Description
A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload using the Cisco ISE GUI. A successful exploit could allow the attacker to upload arbitrary files to an affected system.
A vulnerability exists in the Cisco Identity Services Engine (ISE) GUI, allowing authenticated, remote attackers with administrative privileges to upload files to affected devices. This issue arises from improper validation in the file copy function. Exploitation of this vulnerability could enable the upload of arbitrary files to the system.
Cisco has released software updates to address this vulnerability. For information on which releases include the fix, consult the Cisco ISE advisory or the Cisco Security Advisories page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-qksX6C8g | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cisco identity services engine | < 3.1.0 3.1.0 - 3.1.0 patch1 3.1.0 patch2 3.1.0 patch3 3.1.0 patch4 3.1.0 patch5 3.1.0 patch6 3.1.0 patch7 3.1.0 patch8 3.1.0 patch9 3.2.0 - 3.2.0 patch1 3.2.0 patch2 3.2.0 patch3 3.2.0 patch4 3.2.0 patch5 3.2.0 patch6 3.3.0 - 3.3.0 patch1 3.3.0 patch2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 20, 2025 | CVE Modified | [email protected] |
| Aug 20, 2025 | New CVE Received | [email protected] |