Product:
Cisco ISE
Summary
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because certain files lack proper data protection mechanisms. An attacker with read-only Administrator privileges could exploit this vulnerability by performing actions where the results should only be viewable to a high-privileged user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-20305 |
Exploitation
An attacker with read-only Administrator privileges can exploit this vulnerability by accessing specific files or performing actions that reveal sensitive information, such as passwords, which are typically restricted to high-privileged users. By leveraging their access, the attacker can view data that should not be visible to them, leading to potential information disclosure.
Affected Products
- Cisco ISE: Vulnerable due to improper data protection mechanisms in the web-based management interface.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Cisco. Additionally, organizations should review their access controls and ensure that only authorized personnel have access to sensitive information within the management interface.