High-Severity Cisco ISE Flaw (CVE-2025-20343) Allows Unauthenticated DoS via Crafted RADIUS Requests

Cisco has flagged a high-severity vulnerability in its Identity Services Engine (ISE), CVE-2025-20343, which could allow unauthenticated remote attackers to trigger an unexpected restart and cause a denial-of-service. The flaw arises from a logic error in processing RADIUS access requests for MAC addresses already marked as rejected endpoints, and an attacker could exploit it by sending crafted RADIUS messages to crash and restart the ISE server.

According to Cisco’s advisory, the issue could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. The vulnerability affects ISE releases 3.4.0, 3.4 Patch 1, 3.4 Patch 2 and 3.4 Patch 3, all with the “Reject RADIUS requests from clients with repeated failures” setting enabled by default; earlier versions are not affected. Cisco advises administrators to disable the affected configuration as a temporary workaround, and provides steps to uncheck the setting via the web interface.

The issue is fully resolved in Cisco ISE 3.4 Patch 4, and customers are urged to upgrade to the fixed release as soon as possible to eliminate exposure. Published 7 November 2025.