CVE-2023-20193

A vulnerability in the Embedded Service Router ESR of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate their privileges to root. To exploit this vulnerability, an attacker must have valid...

Authentication flaw

A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS packets. This vulnerability is due to improper handling of certain RADIUS accounting requests. An...

CVE-2023-20243

CVE-2023-20243 describes a denial-of-service in Cisco Identity Services Engine (ISE) due to improper handling of certain RADIUS accounting requests. An unauthenticated, remote attacker can trigger the RADIUS process to restart, causing authentication/authorization timeouts and denying service for...

Credential Information Disclosure Vulnerability(cisco-sa-ise-credentials-tkTO3h3)

According to its self-reported version, Cisco Identity Services Engine is affected by a vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive information. This vulnerability is due to the imprope...

CVE-2023-20111

CVE-2023-20111 affects Cisco Identity Services Engine (ISE). The issue is an improper storage of sensitive information in the web-based management interface, allowing an authenticated, remote attacker to log in and view hidden fields, potentially exposing credentials and enabling further attacks....

Cisco Identity Services Engine Path Traversal Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A path traversal vulnerability exists in Cisco...

Cisco Identity Services Engine Command Injection Vulnerability (cisco-sa-ise-injection-sRQnsEU9)

According to its self-reported version, Cisco Identity Services Engine is affected by a command injection vulnerability, which could allow an authenticated remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these...

Cisco Identity Services Engine Path Traversal Vulnerability (cisco-sa-ise-traversal-ZTUgMYhu) (CSCwd07350)

According to its self-reported version, Cisco Identity Services Engine Path Traversal Vulnerabilities is affected by a path traversal vulnerability. A vulnerability in the CLI of Cisco ISE could allow an authenticated, local attacker to perform a path traversal attack to escape the restricted she...

Input validation

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20087

Summary: CVE-2023-20087 affects Cisco Identity Services Engine (ISE) where the web-based management interface contains input-validation errors that could let an authenticated, remote attacker download arbitrary files from the device filesystem by sending crafted HTTP requests. This is supported b...

CVE-2023-20174

Cisco ISE CVE-2023-20174 refers to multiple vulnerabilities in the web-based management interface, stemming from XML External Entity Injection. When authenticated as an administrator, an attacker could read arbitrary files or perform SSRF via the affected device. The root cause is XML handling in...

CVE-2023-20172

Cisco Identity Services Engine (ISE) is affected by CVE-2023-20172, describing multiple vulnerabilities in ISE that could allow an authenticated attacker to delete or read arbitrary files on the underlying OS. The issues appear to be tied to the web interface and require valid credentials on an a...

CVE-2023-20167

Cisco Identity Services Engine (ISE) contains path traversal vulnerabilities that could let an authenticated Administrator read arbitrary files on the underlying OS or escalate to root. The issue affects ISE’s web management interface and is caused by improper validation of user-supplied input, r...

CVE-2023-20171

Cisco Identity Services Engine (ISE) is affected by CVE-2023-20171: authenticated, credentialed attackers can delete or read arbitrary files on the OS. Affected versions include Cisco ISE 3.1.x before 3.1P6 and 3.2.x before 3.2P2. Cisco and third-party advisories (e.g., Cisco security advisory ci...

CVE-2023-20173

Cisco Identity Services Engine (ISE) is affected by CVE-2023-20173, an XML External Entity Injection vulnerability in the web-based management interface that can allow an authenticated, remote attacker with valid Administrator credentials to read arbitrary files or perform SSRF. The exploitation ...

CVE-2023-20163

CVE-2023-20163 concerns Cisco Identity Services Engine (ISE) command injection vulnerabilities. The affected product is ISE; the underlying issue enables an authenticated attacker with valid credentials to perform command injections on the OS and elevate to root. Exploitation context and impact a...

CVE-2023-20164

CVE-2023-20164 affects Cisco Identity Services Engine (ISE). The vulnerability is a command injection in ISE that could allow an authenticated attacker (with valid credentials on an affected device) to execute commands on the underlying OS and potentially gain root privileges. Exploitation detail...

CVE-2023-20106

Cisco Identity Services Engine (ISE) contains authenticated-file-delete/read vulnerabilities (CVE-2023-20106) that allow an attacker with valid credentials to delete or read arbitrary OS files. Affected lines point to ISE releases prior to 3.1P6 (3.1.x) and prior to 3.2P2 (3.2.x). The Cisco advis...

CVE-2023-20087 Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20077

CVE-2023-20077 affects Cisco Identity Services Engine (ISE). The web-based management interface contains input-validation vulnerabilities that allow an authenticated, remote attacker to download arbitrary files from the device filesystem by sending crafted HTTP requests. Impact is confirmed as ar...