Introduction
A vulnerability in Cisco Identity Services Engine (ISE), a widely deployed network access control product, lets a remote attacker cause a denial of service by sending crafted RADIUS requests.
Cisco is a major enterprise networking vendor, and ISE is a central authentication, authorization, and accounting (AAA) platform for organizations worldwide. They use it to enforce network policies, manage device access, and onboard users and endpoints securely. When ISE restarts unexpectedly, the networks that depend on it can lose authentication, which disrupts business operations and can leave critical infrastructure inaccessible.
Technical Information
CVE-2025-20343 is a logic error in the RADIUS suppression feature of Cisco ISE. The feature is controlled by the setting 'Reject RADIUS requests from clients with repeated failures'. It suppresses repeated failed authentication attempts from the same endpoint, identified by MAC address, to reduce log noise and resource consumption.
With the setting enabled, ISE tracks endpoints that fail authentication multiple times and marks them as rejected. An attacker triggers the vulnerability by sending a specific sequence of RADIUS access requests for a MAC address that is already in the rejected state. Because of an incorrect comparison or state validation (classified as CWE-697: Incorrect Comparison), ISE mishandles these requests, enters an unexpected state, and restarts. The restart denies service to all authentication services handled by the affected ISE node.
Key technical points:
- The attack is unauthenticated. It needs no valid credentials or prior authentication, only network access to the RADIUS service (UDP ports 1645/1812).
- ISE runs the vulnerable code path only when the suppression feature is enabled and the target MAC address is already marked as rejected.
- The root cause is a logic error in how ISE processes RADIUS requests for endpoints it has already rejected.
- As of this writing, no public code snippets or exploit scripts are available.
Affected Systems and Versions
- Cisco Identity Services Engine (ISE) versions 3.4.0, 3.4 Patch 1, 3.4 Patch 2, and 3.4 Patch 3 are affected.
- The vulnerability is present only when the 'Reject RADIUS requests from clients with repeated failures' setting is enabled.
- Other versions, such as 3.3 and earlier, are not listed as affected by this issue.
- Standalone and distributed ISE deployments are both affected when the vulnerable setting is active.
Vendor Security History
Cisco has disclosed several RADIUS-related vulnerabilities in ISE during 2025, including CVE-2025-20152, CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337. They range from denial of service to remote code execution. Cisco usually publishes advisories and patches promptly, but the repeated RADIUS processing flaws suggest deeper architectural or implementation problems in this part of ISE.
