CVE-2025-20303: identity services engine 3.2.0, 3.3.0, 3.4.0; +1 more affected products

Affected technology

identity services engine · through 3.1.0 (inclusive)
cisco

identity services engine · 3.2.0
cisco

identity services engine · 3.2.0 · update patch1
cisco

identity services engine · 3.2.0 · update patch2
cisco

identity services engine · 3.2.0 · update patch3
cisco

identity services engine · 3.2.0 · update patch4
cisco

identity services engine · 3.2.0 · update patch5
cisco

identity services engine · 3.2.0 · update patch6
cisco

identity services engine · 3.2.0 · update patch7
cisco

identity services engine · 3.3.0
cisco

identity services engine · 3.3.0 · update patch1
cisco

identity services engine · 3.3.0 · update patch2
cisco

identity services engine · 3.3.0 · update patch3
cisco

identity services engine · 3.3.0 · update patch4
cisco

identity services engine · 3.3.0 · update patch5
cisco

identity services engine · 3.3.0 · update patch6
cisco

identity services engine · 3.3.0 · update patch7
cisco

identity services engine · 3.4.0
cisco

identity services engine · 3.4.0 · update patch1
cisco

identity services engine · 3.4.0 · update patch2
cisco

identity services engine · 3.4.0 · update patch3
cisco

Cisco Identity Services Engine Software · 3.1.0, 3.1.0 p1, 3.1.0 p3, 3.1.0 p2, 3.1.0 p4, 3.1.0 p5, 3.1.0 p6, 3.1.0 p7, 3.1.0 p8, 3.1.0 p9, 3.1.0 p10, 3.2.0, 3.2.0 p1, 3.2.0 p2, 3.2.0 p3, 3.2.0 p4, 3.2.0 p5, 3.2.0 p6, 3.2.0 p7, 3.3.0, 3.3 Patch 2, 3.3 Patch 1, 3.3 Patch 3, 3.3 Patch 4, 3.3 Patch 5, 3.3 Patch 6, 3.3 Patch 7, 3.4.0, 3.4 Patch 1, 3.4 Patch 2, 3.4 Patch 3
Cisco

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An authenticated, remote attacker could conduct a reflected XSS attack against a user of the interface. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.