Advisory Details

July 17th, 2025

Cisco Identity Services Engine IpAccessFilter Direct Request Authentication Bypass Vulnerability

ZDI-25-605
ZDI-CAN-26480

CVE ID CVE-2025-20285
CVSS SCORE 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS Cisco
AFFECTED PRODUCTS Identity Services Engine
VULNERABILITY DETAILS

This vulnerability allows remote attackers to bypass IP restrictions on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability.

The specific flaw exists within the configuration of the web.xml file. The issue results from an incomplete Spring Boot filter mapping. An attacker can leverage this vulnerability to bypass IP restrictions on the system.
ADDITIONAL DETAILS Cisco has issued an update to correct this vulnerability. More details can be found at:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO
DISCLOSURE TIMELINE
  • 2025-05-06 - Vulnerability reported to vendor
  • 2025-07-17 - Coordinated public release of advisory
  • 2025-07-17 - Advisory Updated
CREDIT Kentaro Kawane of GMO Cybersecurity by Ierae
BACK TO ADVISORIES