Nine security advisories address multiple vulnerabilities, including one critical and two high severity advisories

Threat ID:CC-4614

Threat Severity:Medium

Published:6 February 2025 3:11 PM

Summary

Affected platforms

The following platforms are known to be affected:

Cisco ISEAlso affects Cisco ISE Passive Identity Connector (ISE-PIC)

Cisco NX-OS

Cisco Expressway Series

Cisco IOS

Cisco IOS XE

Cisco IOS XR

Cisco Secure Email and Web Manager

Cisco Secure Email Gateway

Cisco Secure Web Appliance

Threat details

Introduction

Cisco has released nine security advisories addressing multiple vulnerabilities, including one critical and two high severity advisories affecting Cisco Identity Services Engine (ISE), Cisco NX-OS, Cisco Expressway, Cisco IOS, Cisco IOS XE, Cisco IOS XR, Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance.

The critical vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector, software which facilitates endpoint management. The vulnerability could allow an authenticated, remote attacker to execute arbitrary commands and elevate privileges on an affected device, provided that the attacker has valid read-only administrative credentials.

One high severity advisory affects Cisco NX-OS Software, which is a network operating system. This vulnerability could allow an attacker to bypass NX-OS image signature verification and load unverified software.

The other high severity advisory details vulnerabilities affecting Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software, which are networking software systems. The vulnerabilities could allow an authenticated, remote attacker to conduct a denial-of-service (DoS) attack on an affected device.

Additionally, six medium severity advisories were also issued.

Remediation advice

Affected organisations are encouraged to review Cisco's security advisories.

Remediation steps


Patch	Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities \| cisco-sa-ise-multivuls-FTW9AOXF https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXF
Patch	Cisco NX-OS Software Image Verification Bypass Vulnerability \| cisco-sa-nxos-image-sig-bypas-pQDRQvjL https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-image-sig-bypas-pQDRQvjL
Patch	Cisco IOS, IOS XE, and IOS XR Software SNMP Denial of Service Vulnerabilities \| cisco-sa-snmp-dos-sdxnSUcW https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-dos-sdxnSUcW
Patch	Cisco Secure Web Appliance Range Request Bypass Vulnerability \| cisco-sa-swa-range-bypass-2BsEHYSu https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swa-range-bypass-2BsEHYSu
Patch	Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities \| cisco-sa-ise-xss-42tgsdMG https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-42tgsdMG
Patch	Cisco Expressway Series Cross-Site Scripting Vulnerability \| cisco-sa-expressway-xss-uexUZrEW https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-xss-uexUZrEW
Patch	Cisco Secure Email and Web Manager and Secure Email Gateway Cross-Site Scripting Vulnerability \| cisco-sa-esa-sma-xss-WCk2WcuG https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-xss-WCk2WcuG
Patch	Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance SNMP Polling Information Disclosure Vulnerability \| cisco-sa-esa-sma-wsa-snmp-inf-FqPvL8sX https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-snmp-inf-FqPvL8sX
Patch	Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Vulnerabilities \| cisco-sa-esa-sma-wsa-multi-yKUJhS34 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-multi-yKUJhS34

Definitive source of threat updates

https://sec.cloudapps.cisco.com/security/center/publicationListing.x

CVE Vulnerabilities

StatusPublished

CVE-2025-20124A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object to an affected API. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges. Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.

StatusPublished

CVE-2025-20125A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node. This vulnerability is due to a lack of authorization in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to attacker to obtain information, modify system configuration, and reload the device. Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.

StatusPublished

CVE-2024-20397A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification.  This vulnerability is due to insecure bootloader settings. An attacker could exploit this vulnerability by executing a series of bootloader commands. A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.

StatusPublished

CVE-2025-20169A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.  This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.

StatusPublished

CVE-2025-20172A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. For Cisco IOS and IOS XE Software, a successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. For Cisco IOS XR Software, a successful exploit could allow the attacker to cause the SNMP process to restart, resulting in an interrupted SNMP response from an affected device. Devices that are running Cisco IOS XR Software will not reload.  This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.

Last edited: 6 February 2025 3:11 pm