POC详情： 2f6cbd043fdca9218e0213cd326a6d6f949e226e

来源
https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC
关联漏洞
标题： Cisco ISE和Cisco ISE-PIC 安全漏洞 (CVE-2025-20282)
描述：Cisco ISE和Cisco ISE-PIC都是美国思科（Cisco）公司的产品。Cisco ISE是一个 NAC 解决方案。用于管理零信任架构中的端点、用户和设备对网络资源的访问。Cisco ISE-PIC是一个组件。 Cisco ISE和Cisco ISE-PIC存在安全漏洞，该漏洞源于文件验证不足，可能导致上传和执行任意文件。
描述
Proof of concept of CVE-2025-20282, the perfect 10.
介绍
Cisco ISE CVE 2025-20282

Proof of concept


The python script abuses the upload function that is availible unauthenticated at /admin/files-upload/ 

The script locally creates a bin folder and a file named isehourlycron.sh and fills it with the (the file is base64 encoded and included in the script) original content from Cisco ISE installation (located in /opt/CSMS/bin) folder.

A command is then added at the end of the file. Unless you specify "--reset", in that case the command will not be added and the file will be reverted to the original content.

The script then zips that folder recursivly with its content to a file named output.zip.

The file is then uploaded to the ISE installation using the /admin/files-upload/.

On the Cisco ISE side, the output.zip will be placed in /tmp/ and all its content will be extracted to /opt/CSCOcpm/ folder. 

The isehourlycron.sh runs as root several times within an hour. Allowing for remote code execution as ROOT.
文件快照

 [4.0K]  /data/pocs/2f6cbd043fdca9218e0213cd326a6d6f949e226e
├── [ 64K]  CVE-2025-20282 - v2.py
└── [ 969]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。