Unauthenticated RCE in Cisco ISE and ISE-PIC API

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-20281, a critical unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) versions 3.3 and 3.4.0. The exploit is implemented in a single Python script (CVE-2025-20281.py), which sends a crafted POST request to the ERS API endpoint (https://<target>:9060/ers/sdk#_) without authentication. The payload injects arbitrary shell commands into the 'name' field, exploiting insufficient input validation to achieve root-level command execution. The script supports running a simple command (e.g., 'whoami') or spawning a reverse shell to an attacker-controlled host. The README.md provides detailed vulnerability information, affected versions, remediation steps, and responsible use guidelines. The exploit requires Python 3.6+ and the 'requests' and 'urllib3' libraries. No detection or scanning functionality is present; the code is strictly for exploitation.

This repository provides a Python 3 proof-of-concept exploit for CVE-2025-20281, a critical unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE) via the ERS API. The main exploit script (CVE-2025-20281.py) allows an attacker to send a specially crafted POST request to the /ers/sdk#_ endpoint on TCP port 9060, injecting shell commands through the 'name' parameter of an InternalUser object. The script supports executing arbitrary commands, running a quick 'whoami' test, or launching a bash reverse shell to an attacker-controlled host. No authentication is required, and the exploit is effective against Cisco ISE PAN nodes with ERS enabled. The repository includes a README with usage instructions and a LICENSE file. The exploit is operational, providing real RCE capabilities, and is not part of a larger framework.

This repository contains a Python proof-of-concept exploit for CVE-2025-20281, a critical unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE) via the ERS API. The main exploit script, PoC.py, allows an attacker to send a crafted POST request to the InternalUser ERS API endpoint (https://<target>:9060/ers/sdk#_) without authentication. The exploit injects arbitrary shell commands into the 'name' field of the request, which are executed as root on the target system. The script supports two modes: running a simple command (such as 'whoami') or spawning a bash reverse shell to an attacker-controlled host. The repository is minimal, containing only the exploit script, a README with usage instructions, and a license file. No detection or fake code is present; this is a functional proof-of-concept exploit.