CVE-2025-20281-2-Cisco-ISE-RCE

CVE-2025-20281-2-Cisco-ISE-RCE Cisco ISE API에 대한 인증되지 않은 CVE-2025-20281 RCE Python PoC CVE-2025-20281 인증되지 않은 PoC Cisco ISE의 ERS API에서 인증되지 않은 RCECVE-2025-20281를 InternalUser 리소스에 임의의 셸 명령을 주입하여 악용하는 최소한의 Python 개념 증명입니다. 경고: 소유하거나 명시적 테스트 권한이 있는 시스템에서만 실행하세요. 이 도구의 오용은 불법입니다. 기능 인증 불필요 두 가지 모드 지...

Cisco-CVE-2025-20281-illdeed

CVE-2025-20281 — Cisco ISE ERS API 미인증 RCE 익스플로잇 이 저장소는 CVE-2025-20281 에 대한 Python 3 개념 증명 익스플로잇입니다. 이는 Cisco Identity Services Engine ISE의 심각한 취약점으로, ERS API를 통해 루트 권한으로 미인증 원격 코드 실행RCE을 가능하게 합니다. 🩻 취약점 개요 Cisco ISE ERS /ers/sdk 엔드포인트는 사용자 생성 요청을 처리할 때 인증을 검증하지 않습니다. InternalUser 객체의 name 매개변수에 ...

EUVD-2023-24373

Malicious code in bioql PyPI...

Cisco Identity Services Engine Privilege Escalation (cisco-sa-ise-priv-esc-KJLp2Aw)

According to its self-reported version, Cisco Identity Services Engine is affected by a privilege escalation vulnerability that allows an authenticated, Administrator-level attacker to read arbitrary files due to a flaw in the ERS API. This can be exploited by sending a crafted request. Please se...

CVE-2023-20194

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

CVE-2023-20194

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

Input validation

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

CVE-2023-20194

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

CVE-2023-20194

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

CVE-2023-20194

Cisco ISE ERS API vulnerability (CVE-2023-20194) allows an authenticated Administrator to read arbitrary OS files due to improper privilege management in the ERS API. Exploitation requires valid admin privileges and a crafted ERS API request; impact is information disclosure and potential privile...

CVE-2022-20959

A vulnerability in the External RESTful Services ERS API of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient input...

CVE-2022-20959

CVE-2022-20959 affects Cisco Identity Services Engine (ISE) via the External RESTful Services (ERS) API. The issue arises from insufficient input validation, allowing an authenticated, remote attacker to trick an administrator into clicking a malicious link, leading to cross-site scripting (XSS) ...

Cisco Identity Services Engine XSS (cisco-sa-ise-xss-twLnpy3M)

According to its self-reported version, Cisco Identity Services Engine is affected by a cross-site scripting XSS vulnerability due to insufficient input validation in the External RESTful Services ERS API. An attacker could exploit this vulnerability by persuading an authenticated administrator o...

CVE-2022-20914 Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

A vulnerability in the External RESTful Services ERS API of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to excessive verbosity in a specific REST API output. An attacker could exploit this...

CVE-2022-20914

CVE-2022-20914 affects Cisco Identity Services Engine (ISE) via the External RESTful Services (ERS) API. The root cause is excessive verbosity in a REST API output, enabling an authenticated attacker (with ERS admin credentials) to retrieve sensitive information, including admin credentials for a...

Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

A vulnerability in the External RESTful Services ERS API of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to excessive verbosity in a specific REST API output. An attacker could exploit this...

Cisco Identity Services Engine Arbitrary Client Certificate Creation Vulnerability

A vulnerability in the External RESTful Services ERS API of the Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to generate arbitrary certificates signed by the InternalCertificate Authority CA Services on ISE. This vulnerability is due to an incorrect...

CVE-2019-1851

CVE-2019-1851 concerns Cisco Identity Services Engine (ISE) where the External RESTful Services (ERS) API contains an RBAC flaw that lets an authenticated attacker craft requests with admin credentials to generate arbitrary certificates signed by the Internal CA. The root cause is improper RBAC i...

CVE-2019-1851 Cisco Identity Services Engine Arbitrary Client Certificate Creation Vulnerability

A vulnerability in the External RESTful Services ERS API of the Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority CA Services on ISE. This vulnerability is due to an incorrect...

CVE-2019-1851 Cisco Identity Services Engine Arbitrary Client Certificate Creation Vulnerability

A vulnerability in the External RESTful Services ERS API of the Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority CA Services on ISE. This vulnerability is due to an incorrect...