Cisco Identity Services Engine (cisco-sa-ise-cmd-inj-5WSJcYJB)

#TRUSTED 3147fa82a68ad0b733b1094cce3f89f0b4d58fbbf60ce54ee366dd386ae7ed76c9bdea9ffc3821ff28d2f28f877992526d61a32edb7ed1e526ec95d56ca0f5e0c9625bc63206cba6f2006bd8a4d6f540066dd349ad0b3f30d7c5eb02c1485b2510326390a98d3161b5c64ba72e7d9810429c6a5d641459ab0327c9c9d5a69b9e290eb2ad243073f794cc517e9706d052f25d79c71a583f8a0a7c6c6aacd35639308d9ab0f2e88c35e45955285fa86869f11f1e48f63b520049e35135165b6ea276c4b99e6c591d006a2208e4276789d3f5b85b820713173b118c14a82ef1794987ab4fb48b8ac3e5d547349e3ebe5485e7eac8717911a4479e5d246c8406bf6aba1bf15577774fb6b3a79fe91d20225b07340f78cbd510de063c4f23b97ff50e77c3c1ce70f9d4a323c4ca0fe3a336e7dfa1905395d83b4073e020ff60640775b783718a3cd184529658679568635cb8eb44703d6fffbc9a8c8a3adffc0c2f1f21ba2ad057e3cb4307f5c8cd507d36b79badd9a9c5f1463884879b8fe7514e1c6861fa9af72a18303c865a47c12a6f82f6bc1506e1194c9e3ebf0ffca6c1338bcddbceb37e9cc749f91cfbc5a14540a3c9ec33f1c8b87ac1a45b82b8e14f3300f704417277c1ef0629762b9604d9e8e825b07096f49c6b26437dde83d429a3929bdb480e9ddbcd4078f20fe4353d2c62e7c12a5a4a1cbd65916ad758c90f23e3
#TRUST-RSA-SHA256 05cc5aac247bfcf41db2efc8dec28185f5e4b8686563126c400c56c4d436bd9bf0eba190a9b3c9baeb8d3d7f50b79387b6206a5e8a0bad0ab168a4de279c4c2a0fbfa0a8f84ea60225289903befee8b73e90bee063c00f316a888ef346d4008d90edb986252de841a5fcc8bf8c815805a18ec9749f0d89c8103fbb48abb67203f211a5c590f1fe93b8627b4e1350ecf90e2c8b2b9c0ea47aded18467ecad38c83a4a3a6fbda078cc1e077727290ea57d09b8467e978cf820e24e057cdd3ea3b68c8b195b67429c45bdebb19fbc464fda98561629b1ebe89bc6461a4c7aa8ba73b2c3c60f5c04778fdbf2b095caece6f6c75759e785c5496240647ee61ed2d5b01cc742e80ccf1396a14a7aa9d60381ec0bd56ab1720dccd63d97956166432d1dd6aad4ab982256be33f9b58d9e2f92df3354abc0bca51f827c37f647cacf1153a944c21c1053d71101a947ac72adceb39a309f1d1e5b59d66fc9a0e14abb9d22e7f9367f1940527d3692793bcbac3a073263bdade590a031a1a807b1b64f80a385b6f24be0d42c6af0098062f9cb73ae204a6fdee3f9ecb54d5fba7f01431dce73086125c9c3a20c4b2204c87a8e905afa22b8d175b35b9fbc6627ede349f36368212ffedd3e307eeaa66c775b6090ab92afa37c38c82103a7a84f6acac1b3b94ce616a268b2c39cbeed96a2287ef74f7e60a6a62bb5060b465dfbfe977e3751
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(306559);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/17");

  script_cve_id("CVE-2026-20136");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwp98770");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-cmd-inj-5WSJcYJB");
  script_xref(name:"IAVA", value:"2026-A-0357");

  script_name(english:"Cisco Identity Services Engine (cisco-sa-ise-cmd-inj-5WSJcYJB)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by a vulnerability.

  - A vulnerability in theCLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity
    Connector (ISE-PIC) could allow an authenticated, local attacker with administrative privileges to perform
    a command injection attack on the underlying operating system and elevate privileges to root. This
    vulnerability is due to insufficient validation of user supplied input. An attacker could exploit this
    vulnerability by providing crafted input to a specific CLI command. A successful exploit could allow the
    attacker to elevate their privileges to root on the underlying operating system. (CVE-2026-20136)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-5WSJcYJB
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b03a941b");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp98770");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwp98770");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20136");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(116);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.3', 'required_patch': '11'},
 {'min_ver': '3.4', 'fix_ver': '3.4', 'required_patch': '6'},
 {'min_ver': '3.5', 'fix_ver': '3.5', 'required_patch': '3'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwp98770',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);