certfr_avis - certfr-2025-avi-0539

CERTFR-2025-AVI-0539

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Cisco Identity Services Engine. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

Cisco indique que les vulnérabilités CVE-2025-20281 et CVE-2025-20337 sont activement exploitées.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Cisco	Identity Services Engine	Identity Services Engine (ISE) et ISE Passive Identity Connector (ISE-PIC) versions 3.3.x sans le correctif 3.3 Patch 6ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz
	Cisco	Identity Services Engine	Identity Services Engine (ISE) et ISE Passive Identity Connector (ISE-PIC) versions 3.4.x sans le correctif 3.4 Patch 2ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-ise-unauth-rce-ZAd2GnJ6

2025-06-25

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Identity Services Engine (ISE) et ISE Passive Identity Connector (ISE-PIC) versions 3.3.x sans le correctif 3.3 Patch 6ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz",
      "product": {
        "name": "Identity Services Engine",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Identity Services Engine (ISE) et ISE Passive Identity Connector (ISE-PIC) versions 3.4.x sans le correctif 3.4 Patch 2ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz",
      "product": {
        "name": "Identity Services Engine",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-20281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20281"
    },
    {
      "name": "CVE-2025-20337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20337"
    },
    {
      "name": "CVE-2025-20282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20282"
    }
  ],
  "initial_release_date": "2025-06-26T00:00:00",
  "last_revision_date": "2025-08-01T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0539",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-06-26T00:00:00.000000"
    },
    {
      "description": "Ajout de la vuln\u00e9rabilit\u00e9 CVE-2025-20337",
      "revision_date": "2025-07-17T00:00:00.000000"
    },
    {
      "description": "L\u0027\u00e9diteur indique que les vuln\u00e9rabilit\u00e9s CVE-2025-20281, CVE-2025-20282 et CVE-2025-20337 sont activement exploit\u00e9es.",
      "revision_date": "2025-07-22T00:00:00.000000"
    },
    {
      "description": "La vuln\u00e9rabilit\u00e9 CVE-2025-20282 n\u0027est plus annonc\u00e9e comme exploit\u00e9e par l\u0027\u00e9diteur.",
      "revision_date": "2025-08-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco Identity Services Engine. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nCisco indique que les vuln\u00e9rabilit\u00e9s CVE-2025-20281 et CVE-2025-20337 sont activement exploit\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco Identity Services Engine",
  "vendor_advisories": [
    {
      "published_at": "2025-06-25",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ise-unauth-rce-ZAd2GnJ6",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6"
    }
  ]
}

CVE-2025-20281 (GCVE-0-2025-20281)

Vulnerability from cvelistv5

Published

2025-06-25 16:11

Modified

2025-10-21 22:45

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Summary

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Identity Services Engine Software	Version: 3.3.0 Version: 3.3 Patch 2 Version: 3.3 Patch 1 Version: 3.3 Patch 3 Version: 3.4.0 Version: 3.3 Patch 4 Version: 3.4 Patch 1 Version: 3.3 Patch 5 Version: 3.3 Patch 6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20281",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-26T03:55:51.221716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-07-28",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:45:23.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "technical-description"
            ],
            "url": "https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-07-28T00:00:00+00:00",
            "value": "CVE-2025-20281 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 4"
            },
            {
              "status": "affected",
              "version": "3.4 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 5"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "In July 2025, the Cisco PSIRT became aware of attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate these vulnerabilities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-25T12:26:24.542Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
        "defects": [
          "CSCwo99449"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco ISE API Unauthenticated Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20281",
    "datePublished": "2025-06-25T16:11:42.285Z",
    "dateReserved": "2024-10-10T19:15:13.247Z",
    "dateUpdated": "2025-10-21T22:45:23.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-20282 (GCVE-0-2025-20282)

Vulnerability from cvelistv5

Published

2025-06-25 16:29

Modified

2025-07-25 12:26

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Summary

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Identity Services Engine Software	Version: 3.4.0 Version: 3.4 Patch 1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20282",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-26T03:55:25.749Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.4.0"
            },
            {
              "status": "affected",
              "version": "3.4 Patch 1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.\r\n\r\nThis vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-25T12:26:24.545Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
        "defects": [
          "CSCwp02821"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco ISE API Unauthenticated Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20282",
    "datePublished": "2025-06-25T16:29:12.357Z",
    "dateReserved": "2024-10-10T19:15:13.248Z",
    "dateUpdated": "2025-07-25T12:26:24.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-20337 (GCVE-0-2025-20337)

Vulnerability from cvelistv5

Published

2025-07-16 16:17

Modified

2025-10-21 22:45

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Summary

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

Impacted products

Vendor

Product

Version

Cisco

Cisco Identity Services Engine Software

Version: 3.3.0
Version: 3.3 Patch 2
Version: 3.3 Patch 1
Version: 3.3 Patch 3
Version: 3.4.0
Version: 3.3 Patch 4
Version: 3.4 Patch 1
Version: 3.3 Patch 5
Version: 3.3 Patch 6

Cisco

Cisco ISE Passive Identity Connector

Version: 3.2.0
Version: 3.1.0
Version: 3.3.0
Version: 3.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20337",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-26T03:55:52.398837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-07-28",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:45:22.287Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-07-28T00:00:00+00:00",
            "value": "CVE-2025-20337 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 4"
            },
            {
              "status": "affected",
              "version": "3.4 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 5"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 6"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Cisco ISE Passive Identity Connector",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "In July 2025, the Cisco PSIRT became aware of attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate these vulnerabilities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-25T12:26:22.077Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
        "defects": [
          "CSCwo99449"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco ISE API Unauthenticated Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20337",
    "datePublished": "2025-07-16T16:17:04.664Z",
    "dateReserved": "2024-10-10T19:15:13.255Z",
    "dateUpdated": "2025-10-21T22:45:22.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0539

Vulnerability from certfr_avis

Solutions

CVE-2025-20281 (GCVE-0-2025-20281)

Vulnerability from cvelistv5

CVE-2025-20282 (GCVE-0-2025-20282)

Vulnerability from cvelistv5

CVE-2025-20337 (GCVE-0-2025-20337)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature