Cisco Identity Services Engine (cisco-sa-ise-traversal-xNt7wb2Y)

#TRUSTED 47a5723c57908a76b40e7ad88d7d4d497c859b9d51c4757eedf2e405927b9d55f3b13c4bfb0448792255480aed150a187747f402158a23cbfd70cf787daa784ca8cec0192a61636b729ba61ed6b6c5a786d1e2958350ade50fdf2f6192f767c6919aad2c1f3028712e9e0d8264778dd62370a9e99e13eef591e61da60d62cf4198f1bee3a45e3cf3eee545be7e48c809315e8781396267b8344d815baadd898c8184d055ffe7be0f2509cf696380aeaaeac2651a0df0c9f0c25284bb1328b3f7038b9aebf83fa8675af6768f1adbe75901d0489ef0f228274ff1bdb60c04b0011f510b29d105e2844fec7ae7c9e8a6bd11e467a605cd6f0331e2eb16bb3c87bb00157ead12ab0f59616fba8fb90182701a80ce1df155b0b4339efb0c643980363d1c50983a06da212e49a3b887c4a2c6d054c9a32be9443117d2f6bf525ea02bedf8da4c3431995c49bce2a7e056744715489686cb3c0fffc5e9392d20d5a097fd354e04dba6558a4a46a34835cea6fc03bbee8592f3f09622592f63825def67a26b1d36da83caad1b8d92900dcb51a9040f7fecee7c24411bafdc53da4a377c5c64ba722e6c5686fced437c4ca0f1b7705157e4d2973a1d60cd0b37ff265646692b007e99739834671369e176626cccad7816d499822d16a687d65205cc4709e6ffe950fdcc28e1b344bd186c643d1ad3b24f2be6757cc3cf0316fa006c6da5
#TRUST-RSA-SHA256 372b5cbde90517ff431e4467920f898c70393ee370ed0d51616c04e356cdba576d8d5fbff9d13d86ea4a6b55bd6b0d6fbf7a1c5c35d67bc012232e9750e67d60eabfee76553f59c9081ffd41acbba3f9a8089065797819bddb230c507183c97df31fed219dd988ae6051f40a3e679a23db47f44567664143dd80e2d8ae31b588d3c9f7a8f74f79305830640f0e5b9b0a3f0d8b574a690c02d6690c037f080489740893b5f2a3f49adb8d27daf053c10702992a8c239ddce7ebd922c7d6961edf325ddf82dae6b6c2c6c9406b081411031bb69d0aa7d44c8bcb784301ac8fa42affa79b021d30aa8f438dcde7099dbf51c88668006ee8e521552668e1a9d38c3d5f27c31c59d61fc5e89e9e88d4284ee5b531923ff3721654f8aacba77b1f26e617b20abb5db7df4dbc614c4612a84ad07ad059cc921e7ff7406990a3d8807fcdc73ac672fb3b9a7576dd41889f5baa7020ff96f6874ab4f1c22fde24b15d9aa807b28466d04ac79eab950912e977bf976f4dc23641fdbc7dd2adfc44af1675f08187dd567dab0b68f06e4a96ad0e06ac27145f42aac3d05ff53f3c8b0228da116e13a83db7b2f05bcd6d1c0374da546813a49cb9c3690cd86dcd2d4cae8541f958531f3e2822f62fe41a14d541088b4b42508305c5428390198d54807f1b626b0e0954c88816637586f15c49c7e4f2eb297fa514686c91b212747f0089189527
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(327091);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/15");

  script_cve_id("CVE-2026-20146");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu05826");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-traversal-xNt7wb2Y");

  script_name(english:"Cisco Identity Services Engine (cisco-sa-ise-traversal-xNt7wb2Y)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by a vulnerability.

  - A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC)
    could allow an authenticated, remote attacker to perform path traversal attacks on the underlying
    operating system to either read or delete arbitrary files. To exploit this vulnerability, the attacker
    must have valid administrative credentials. This vulnerability is due to improper validation of
    user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an
    affected system. A successful exploit could allow the attacker to access sensitive files or delete
    arbitrary files on the affected system. (CVE-2026-20146)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-xNt7wb2Y
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0a41cb37");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu05826");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu05826");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20146");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.3', 'required_patch': '12'},
 {'min_ver': '3.4', 'fix_ver': '3.4', 'required_patch': '7'},
 {'min_ver': '3.5', 'fix_ver': '3.5', 'required_patch': '4'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwu05826',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);