CVE-2024-20469

2024-09-0417:15:13

CWE-78

cisco

web.nvd.nist.gov

cisco identity services engine

cli commands

command injection

authenticated attacker

elevated privileges

insufficient validation

crafted cli command

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

AI Score

7.4

Confidence

High

EPSS

Percentile

10.2%

JSON

A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid Administrator privileges on an affected device.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.

Affected configurations

Vulners

Node

ciscoidentity_services_engine_softwareMatch3.2.0

ciscoidentity_services_engine_softwareMatch3.3.0

VendorProductVersionCPE
ciscoidentity_services_engine_software3.2.0cpe:2.3:a:cisco:identity_services_engine_software:3.2.0:*:*:*:*:*:*:*
ciscoidentity_services_engine_software3.3.0cpe:2.3:a:cisco:identity_services_engine_software:3.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	identity_services_engine_software	3.2.0	cpe:2.3:a:cisco:identity_services_engine_software:3.2.0:::::::*
cisco	identity_services_engine_software	3.3.0	cpe:2.3:a:cisco:identity_services_engine_software:3.3.0:::::::*

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Identity Services Engine Software",
    "versions": [
      {
        "version": "3.2.0",
        "status": "affected"
      },
      {
        "version": "3.2.0 p1",
        "status": "affected"
      },
      {
        "version": "3.2.0 p2",
        "status": "affected"
      },
      {
        "version": "3.3.0",
        "status": "affected"
      },
      {
        "version": "3.2.0 p3",
        "status": "affected"
      },
      {
        "version": "3.2.0 p4",
        "status": "affected"
      },
      {
        "version": "3.2.0 p5",
        "status": "affected"
      },
      {
        "version": "3.2.0 p6",
        "status": "affected"
      },
      {
        "version": "3.3 Patch 2",
        "status": "affected"
      },
      {
        "version": "3.3 Patch 1",
        "status": "affected"
      },
      {
        "version": "3.3 Patch 3",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]