Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-rce-4fverepv)

#TRUSTED 58a6e605f0bbda88cce10cb731f8c1762a2c9cb90003bdf0d19090188223cc6a7ddeef31aad86b7e006cb914b54f7703eac50cca4c531834b8c339f00fe6f97439f83ad764c814d01950e34e9e5f9cc29fa9fee82080031fcd88e1352fd46e356262d7873eee8785b23ae7632254c2d9d3405412b945c53027487b8bb23a5dcf1c5a541b8f4954112ccaf08f88d6ea687494ae73cffd1d05236d890144d8864a6b4d37a91a4d4a4834501d9880b1aff184a075cae30b3052176c2dc785d5ef5563f55c6e06ffc66b0568d80239c0adac526b4786a939730eaef989a93728e8c6191a50f0d2f6a016e43c72055ce1c9e318051d0195e9b96e45466a7f6c1a3a5b42443ead4baff836974a668f9f3e8b088f9ca2d57e928a5e5899c2048f728af219d7677c166343a65936f673f6afce56f71e44d75b83c51a9c9f81a041d12e961f56074a7f3fed71b954199915a8d881bf528f2c84f188f2422669a6781b7716784cb7b6a7b5543121cd6fadc81f797ab20587bcde88b0d6b977fe4c77106b78caf814ea6d333d1ea26d6bb3934556619c16dd74a42ba19f3e2f0de4ae44b2c7eb532f70b949129e3e2004db1ecd3ca2add7e55b97103e7eff267ebe2d46286c237cf9bd31931feac78e7ddb376cd48b8797e8c9c5e58e47d47f13ee3cce5e7e14eef3f84c98fd9960724e57cfa74c073c75ddd09ea17500825ef3aeab70d55b
#TRUST-RSA-SHA256 b12f8b4bd49d41c28d930453a3e642fa54a306757f8ae5fd489a117999dbb086c1a9fdcf863d8e6bb09564edf0c8f88aa1682cf09c892ac329b16e57af50ac38d00219fa1cbcb9f8f3b539cef4e0d765f4e5ff4e0bef2e29c07dd547c9f850d91310fa401d6b651a8d651a0f3efc3e827f2273e3265933bc5258ffa3beec14660e9377e8623b61cd2f3899f9eae908de4dbb7325bab4c0a3641917bd694bb7536bc2818c4214e0334ff9e85c54d80a1079edb64b574c3ad28719eef3a3badc026dd5e419481eb751454ff780f88620e8b7cacf2ee3019d45234641921ef92b81f0ea778f7c667e494af115a42b5b7a6bd045b20b4ce2e78818139f97ae217910c39cfeaf8019a865a9569a45b7d65f75e54936b271275e4a6125bd6daefef257ffd1b26da8ca765d5cc7890427d1c1b5ae6cf47b71f0297d6b41908d930a14fb95bd69c4a736ad3ab7a0d2c0a9b8a77ed2bafbf3fe44e2d1fc7e65a381bcb0d7a58aec59e6a5c3bb6765293abdfc6911f7e518b0cd21afb629269ff51b6b9528e2d2358d581cb146272323409cb833a296ce3411df51e59f8f02e08582988438ea9cd0ef64f784bd7b465bbfabe6bde168a8ac0abd7cf597f42a3fd65d840da4239c46cf74407bd70d1bfc63b076f790d142de1aa47e6f7492bd11aab7db283c1964668a6b901d1091d48cdf3af253670cad78540baeba65b7901c7825e110c7
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(306554);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/20");

  script_cve_id("CVE-2026-20180", "CVE-2026-20186");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwq21242");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwq22993");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-rce-4fverepv");
  script_xref(name:"IAVA", value:"2026-A-0357");

  script_name(english:"Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-rce-4fverepv)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities.

  - A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to
    execute arbitrary commands on the underlying operating system of an affected device. To exploit this
    vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to
    insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a
    crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-
    level access to the underlying operating system and then elevate privileges toroot. In single-node
    ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to
    become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that
    have not already authenticated would be unable to access the network until the node is restored.
    (CVE-2026-20180, CVE-2026-20186)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aa8ac88e");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwq21242");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwq22993");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwq21242, CSCwq22993");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20186");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(22, 77);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.2', 'required_patch': '8'},
 {'min_ver': '3.3', 'fix_ver': '3.3', 'required_patch': '8'},
 {'min_ver': '3.4', 'fix_ver': '3.4', 'required_patch': '4'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwq21242, CSCwq22993',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);