Cisco Identity Services Engine and Secure Access Control System Support Bundle Download Vulnerability

A vulnerability in Cisco Identity Services Engine and Secure Access Control System could allow an authenticated, remote attacker to gain unauthorized access to program data.

The vulnerability is due to weak authentication and authorization used to control access to support bundles stored on a targeted device. An authenticated, remote attacker could exploit the vulnerability through brute-force authentication attacks. If successful, the attacker could download files contained within the support bundle, possibly resulting in information disclosure.

Cisco has confirmed the vulnerability and released software updates.

The contents of the support bundle determine the overall impact of any exploit. If the files within the support bundle contain confidential information, the attacker could use the information gained to conduct further attacks against a targeted system.