Privilege escalation in Cisco Identity Services Engine (ISE) CLI commands
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2023-20021 CVE-2023-20022 CVE-2023-20023 |
| CWE-ID | CWE-77 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Cisco Identity Services Engine (ISE) Server applications / Other server solutions |
| Vendor |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Command Injection
EUVDB-ID: #VU71745
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-20021
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper input validation when processing input passed to certain CLI commands. A local user with Administrator privileges can execute arbitrary commands as root.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco Identity Services Engine (ISE): before 3.2.0.542 Patch1
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-os-injection-pxhKsDM
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd07340
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Command Injection
EUVDB-ID: #VU71746
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-20022
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper input validation when processing input passed to certain CLI commands. A local user with Administrator privileges can execute arbitrary commands as root.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco Identity Services Engine (ISE): before 3.2.0.542 Patch1
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-os-injection-pxhKsDM
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd07341
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Command Injection
EUVDB-ID: #VU71747
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-20023
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper input validation when processing input passed to certain CLI commands. A local user with Administrator privileges can execute arbitrary commands as root.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco Identity Services Engine (ISE): before 3.2.0.542 Patch1
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-os-injection-pxhKsDM
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd07344
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
