Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)

#TRUSTED a3e11138434ee48477a298cc150ac53b5feca4a968c1c5d130c0ef8412961b5ffa2bb10743ceec52f421698b7fbb06975f5d19c00ac9bd017c0e219fdc09f258ab8092f8529f47f3b9d74a490a5178422d2c25c5d4c72fb82472696b91fca76e16ef160a5aff6f014f59d982e15608f318d0b6739ac5eda6327e7e6290c57a91ab4affa6ab0367f18c60d5358b2f042bea58819669aa9fbdf14ce2b204abd85994dd69c0d97fb31e2f33832100206746e4879c0a56c01884d2ddcbb76d3b7fb4b464ac6a7386893dcf1f9917562f5619f4176389d9a971c78c02a76e37e5027876b4db39a8c7989c12ba5a2ce2665b00e5cbd47182f514a3dcc052546045d06930d178819a99b815adf67c11e030350b2bbdee28ecf289842b42ed780515bd7952a27f12ff61fb65109b079e2225b21e868365189fbf5be437b34d8f09cb8cff7eb6c85198ce1e9c51f4b4d1cf8c6a5c70b19bdf4588404ab8b238dcc62fa2019359f360597b0193d806a60eee77d6d16f8e1b28a19d6ca452709db85e416b66eb889e4f3aa14e9cfcf56958414b0ab64eae494c5f7d233523339e99d2049ae460c7c4b93b50cce142087fc4b0e23b7320b0143fe4c7ea716ea506dcfb6ff36294e0d94c7ddeb482c0f2f9837157c133ad3d2b6fac630ce6abd1f77eb4c3bd7bc7527a34fc2efbb96d848e061b78f710afbee7d8f3a3848c496c26a16e0107b3
#TRUST-RSA-SHA256 077c1bf85cf69c188fb34ba82404fb4d8d27307a99ad939c3b82db82508e7c0a5e422da9d68d931bf4f6f98eeebf0862883ddb72bea84572f5cf485a39824ade4b5f0df4773ee6b2a5f1b4adaf870ec936bae9ef3bed00cc1fdd54a76e8c504256fc26aa5deb97cb3f6436b23969c4a5f6bd723bc62e25364d61371fde581cbf07b5db18ded092ed3fa56d34e5622d9aacb725ed9531aeefa5c1268b924ee52042172fd1627909aee07bbf46bfac6f315ee519a3b2d15fe7e4de71f0883720afae5810f60203947944399818c02856e406c424710bffe74b2dfd809e3013fe40da6042cf28a357e6626e632be540516642f41e2c91fb0137d0acbd8ff7f3e1f08b69316f0fc38d7c7d679e850e651172a95cc7ab4bbe233dc778f2db18cb6c9df416108da5636e404ae455d9ee0db718dcd8a86f0275c35fb1f421e355c8d2a744ff213e8e392540876199c462e02b2f56c3cbe1337b96f045bfe4563657af5665b568c2191d9dad306ea2dbbf45090b819fc0cc494845eb13e2d7bee78d71cccd3d3ded3ad690b3a56d83fea8a5b7d5bdbaa669983f716ae9fe7dc2737bf453b2053a3fc9025190d47d230f764d19c54a742102b549b3e18747576ef731ebecf69de19c67df7030c2caa7bba0780a6100c489d60be0dc1201e8b3bb86d973e60edf58cf88872625c0384b0d19e91b18688ed71c843aa0fe530a492ad908c848
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348168);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/21");

  script_cve_id("CVE-2026-20247", "CVE-2026-20300");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu26088");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu27707");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-sql-inj-3QTKR947");
  script_xref(name:"IAVA", value:"2026-A-1031");

  script_name(english:"Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities.

  - A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection
    attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An
    attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful
    exploit could allow the attacker to modify data in the underlying database. (CVE-2026-20247)

  - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection
    attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-
    privileged administrative credentials. This vulnerability is due to improper validation of user-supplied
    input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A
    successful exploit could allow the attacker to read or modify data in the underlying database.
    (CVE-2026-20300)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-sql-inj-3QTKR947
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?65ad5653");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu26088");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu27707");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwu26088, CSCwu27707");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20247");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(89);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.3', 'required_patch': '12'},
 {'min_ver': '3.4', 'fix_ver': '3.4', 'required_patch': '7'},
 {'min_ver': '3.5', 'fix_ver': '3.5', 'required_patch': '4'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'flags'         , {'sqli':TRUE},
  'bug_id'        , 'CSCwu26088, CSCwu27707',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);