High severity · published Nov 5, 2025
CVE-2025-20343
Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cisco Identity Services Engine Software · Cisco
3.4.0; 3.4 Patch 1; 3.4 Patch 2; 3.4 Patch 3 · source: vendor
IS
Identity Services Engine · Cisco
3.4.0; 3.4.0; 3.4.0; 3.4.0 · source: NVD
Affected product
CI
Cisco Identity Services Engine Software
Cisco
More from Cisco Identity Services Engine Software
10.0
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
10.0
CVE-2025-20337
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
10.0
CVE-2025-20281
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
10.0
CVE-2026-76423
Cisco ISE API Authentication Bypass Vulnerability
10.0
CVE-2026-20130
Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities