CVE-2017-12261 — Incorrect Authorization in Cisco Identity Services Engine

CWE-264CWE-863 — Incorrect Authorization4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 85.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Identity Services EngineCisco Identity Services Engine ExpressCisco Identity Services Engine Virtual Appliance
Timeline
PublishedNov 2
Latest updateMay 13

Description

A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI commands issued at the restricted shell. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. An attacker woul…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

🔴Vulnerability Details

2
GHSA
GHSA-vfpm-r25x-9hg6: A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local att↗2022-05-13
▶
CVEList
CVE-2017-12261: A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local att↗2017-11-02
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Privilege Escalation Vulnerability↗2017-11-01
▶
CVE-2017-12261 — Incorrect Authorization in Cisco | cvebase