topic Re: CSCwn09816 - RADIUS Shared Secret Masking in Network Access Control

CSCwn09816 - RADIUS Shared Secret Masking

Tamas Demeter — Mon, 29 Sep 2025 11:28:22 GMT

Hi,

we have version 3.3.0.430 with patch 3,4,6,7 installed and we are hitting this bug still.

The known fixed version is 3.3.0.430 patch 5. Won't patch 6 and 7 contain the fix from patch 5?

Additionally: we are hitting this when modifying a device on the Administration -> Network devices page (for example adding a new IP will change the Radius password to ******** ) I can easily reproduce this with a test device.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Arne Bier — Mon, 29 Sep 2025 22:47:39 GMT

Patches are supposed to be cumulative - but maybe in this case, the defect CSCwn09816 didn't get included? Hard to say - I would get TAC to look into this.

Do you have the Administration > System Security Settings "show Password in Plaintext" ticked, or unticked?

Re: CSCwn09816 - RADIUS Shared Secret Masking

Tamas Demeter — Tue, 30 Sep 2025 08:07:37 GMT

"show Password in Plaintext" is ticked

I will install patch 5 manually and see if it fixes it. If it doesn't, I open a TAC case.

Thanks for the reply, I'll get back with some info soon.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Tamas Demeter — Thu, 02 Oct 2025 14:35:18 GMT

@Arne Bier some progress, but not the good kind:

Since we had patch 6 and 7 installed, patch 5 was not allowed. So I had to remove 6 and 7, then install patch 5.

The issue is still present.

An easy way to reproduce it is to open a device's page, modify something and DO NOT unhide the password, so it stays hidden. In this way the password will get overwritten with the "*******" value - which is a crazy bug for ISE....

A workaround is to unhide any password before saving modifications.

Can anyone test this in version 3.4, if it still happens or not?

Re: CSCwn09816 - RADIUS Shared Secret Masking

Arne Bier — Mon, 06 Oct 2025 20:53:23 GMT

I can't reproduce this in ISE 3.4. Having said that, I think I have experienced the bug in ISE 3.3 on one or two occasions, and I just thought it was user error. I was not aware of the bug at that time. But it's not a chronic problem and it's only happened once or twice.

I wonder if it might also have something to do with how the browser interacts with the page.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Tamas Demeter — Tue, 07 Oct 2025 07:24:36 GMT

I'm also suspecting the browser, but still it could potentially cause a big user impact. On 3.3 it is chronic, but we were running it for quite a while now and it started to do this recently.

Anyway, I installed 3.4 on our Lab deployment, then installed patch 1 and it broke the whole thing. The ISE application is not starting anymore. I suspect a complete reinstall or maybe I will try installing patch 2 on top of it.

Re: CSCwn09816 - RADIUS Shared Secret Masking

k2no — Wed, 08 Oct 2025 22:55:40 GMT

Hi,

I had this issue couple of time even in ise running from 3.3 Patch 3 to 7.

I never unchecked the show password in plain text from the security settings and it broke few switches authentication.

I suspect this issue was introduced with 3.3 patch 2 with the show password feature that could maybe be activated by default and "unchecked" when the ise "synchronize" your current configuration. On some deployments only one switch is impacted, on other I saw more switches impacted.

I hope the 3.4 will resolve it, but I've the feeling that only fresh 3.4 versions will not be impacted and upgrading from a buggy 3.3 version could keep this issue...

Re: CSCwn09816 - RADIUS Shared Secret Masking

Tamas Demeter — Thu, 09 Oct 2025 13:07:31 GMT

I just reinstalled our LAB device with 3.4 patch 3 and I can confirm the issue still exists. I will open a TAC case about it.

I did a debug in browser (Edge) and it is clear that the hidden password is being sent back to the ISE app server (can't attach screenshot sorry). Probably this is a browser issue.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Dustin Anderson — Thu, 09 Oct 2025 16:46:37 GMT

I have a test unit on 3.4 I can break at will. What browser are you using to try?

I can't reproduce with chrome or Firefox.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Tamas Demeter — Fri, 10 Oct 2025 07:04:00 GMT

Thanks Dustin in advance!

I use Edge, can't use anything else due to company policy.

To test it: Go to Administration -> Network devices -> select a device -> add a new IP address (do not unhide the radius password) -> save

Go back to Network devices -> select the same device -> unhide the password -> for me it will be a bunch of * characters instead of the actual password.

Tested it with Administration -> System -> Settings -> Security settings -> "Show password in plaintext" disabled, but it was the same.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Network Diver — Tue, 14 Oct 2025 09:18:28 GMT

That bug is still alive. Cisco ISE 3.4 patch3, Chrome on MacOS.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Mark Elsen — Tue, 14 Oct 2025 10:30:06 GMT

- @Network Diver Give feedback about your observations to Cisco's TAC ,

Re: CSCwn09816 - RADIUS Shared Secret Masking

Network Diver — Tue, 14 Oct 2025 13:53:11 GMT

Re: CSCwn09816 - RADIUS Shared Secret Masking

Mark Elsen — Tue, 14 Oct 2025 14:07:13 GMT

@Network Diver No worries here pal , I am married (LOL!)

Re: CSCwn09816 - RADIUS Shared Secret Masking

adn25 — Fri, 17 Oct 2025 06:33:34 GMT

Re: CSCwn09816 - RADIUS Shared Secret Masking

Dustin Anderson — Mon, 20 Oct 2025 16:34:11 GMT

Sorry, was out last week.

So tried with Edge and am unable to recreate it. Seems to be an odd issue that maybe has carried over from upgrades? Defiantly seems like a TAC ticket. Too many variables. My test unit started on 3.2, upgraded to 3.3 and then 3.4. Currently on patch 3.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Tamas Demeter — Tue, 21 Oct 2025 14:23:37 GMT

Could be, but I reinstalled our LAB device and the issue remained.

I'm in the process of opening a TAC case for it, but run into issues with our contracts....... anyway I will revert back when it progresses.

Re: CSCwn09816 - RADIUS Shared Secret Masking

Network Diver — Thu, 06 Nov 2025 05:24:08 GMT

Reply from Cisco TAC: There is a new bug that matches this behaviour: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp06928

Re: CSCwn09816 - RADIUS Shared Secret Masking

Tamas Demeter — Tue, 11 Nov 2025 10:34:10 GMT

Indeed, I opened a TAC case and they released a new patch for 3.4 (patch 4) - and it seem to have fixed the issue in our Lab.

The patch for 3.3 will be released at the end of the month, I'm looking forward to patch our Production and test it.

Re: CSCwn09816 - RADIUS Shared Secret Masking

jeaves@cisco.com — Mon, 17 Nov 2025 19:03:37 GMT

Sorry for all the confusion. ISE patches are always cumulative.

CSCwn09816 (RADIUS Shared Secret Masking After Switch Reload Causes Authentication Failures) led the ISE team to add a pop-up message when 'Show Password in Plaintext' option is unchecked.

That pop-up message includes the following text when 'Show Password in Plaintext' option is unchecked: "Disabling this option hides the Show button for Network Device RADIUS shared secrets and IPsec pre-shared keys. The RADIUS shared secret will remain hidden when accessing network devices using the ERS API and during their export. The IPsec pre-shared key will also remain hidden when accessed using Open API. If Cisco ISE is integrated with Cisco Catalyst Center, do not disable this option. Disabling it will lead to incorrect configuration of RADIUS shared secret keys for network devices."

The actual fix for the issue is within Catalyst Center. That DDTS entry is CSCwn51980 (DNAC to Use PATCH operation instead of PUT), documented integrated releases are 2.3.7.10, 3.1.5 and 3.2.1.

Until the permanent fix is implemented, a workaround to recover the password is to manually re-enter the shared secret on ISE and enable the "Show Password in Plaintext" option.