CVE-2023-20170 — Command Injection in Cisco Identity Services Engine Software

CWE-77 — Command InjectionCWE-78 — OS Command Injection4 documents4 sources
Severity
6.7MEDIUMNVD
CNA6.0
EPSS
0.0%
top 90.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services Engine SoftwareCisco Identity Services Engine
Timeline
PublishedNov 1

Description

A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-q87c-3jrw-rr6f: A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlyin↗2023-11-01
▶
CVEList
CVE-2023-20170: A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlyin↗2023-11-01
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Command Injection Vulnerabilities↗2023-11-01
▶
CVE-2023-20170 — Command Injection in Cisco | cvebase