Cisco Identity Services Engine Software vulnerabilities

CVE-2021-1412 [MEDIUM] CWE-266 CVE-2021-1412: Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sensitive data. An attacker with read-only administrator access to the Admin portal could exploit

CVE-2022-20782 [MEDIUM] CWE-266 CVE-2022-20782: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrato

CVE-2024-20469 [MEDIUM] CWE-78 CVE-2024-20469: A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an auth A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid Administrator privileges on an affected device. This vulnerab

CVE-2022-20819 [MEDIUM] CWE-266 CVE-2022-20819: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because administrative privilege levels for sensitive data are not properly enforced. An attacker with read-only privileges for t

CVE-2024-20532 [MEDIUM] CWE-22 CVE-2024-20532: A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and de A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could explo

CVE-2024-20529 [MEDIUM] CWE-22 CVE-2024-20529: A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and de A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could explo

CVE-2024-20527 [MEDIUM] CWE-22 CVE-2024-20527: A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and de A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could explo

CVE-2026-20195 [MEDIUM] CWE-204 CVE-2026-20195: A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user accounts on an affected device. This vulnerability exists because error messages are observed when the affected API endpoint is called. An attacker could exploit this vulnerability by sending a series of crafted

CVE-2023-20021 [MEDIUM] CWE-78 CVE-2023-20021: Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow a Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device. These

CVE-2023-20022 [MEDIUM] CWE-78 CVE-2023-20022: Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow a Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device. These

CVE-2023-20023 [MEDIUM] CWE-78 CVE-2023-20023: Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow a Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device. These

CVE-2023-20152 [MEDIUM] CWE-77 CVE-2023-20152: Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow a Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device. These

CVE-2023-20153 [MEDIUM] CWE-77 CVE-2023-20153: Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow a Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device. These

CVE-2023-20170 [MEDIUM] CWE-77 CVE-2023-20170: A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to insuffici

CVE-2023-20166 [MEDIUM] CWE-24 CVE-2023-20166: Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attack Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying operating system to either elevate privileges to root or read arbitrary files. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. For mo

CVE-2023-20193 [MEDIUM] CWE-78 CVE-2023-20193: A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, loca A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate their privileges to root. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulner

CVE-2023-20030 [MEDIUM] CWE-611 CVE-2023-20030: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an affected device, or negatively impact the responsiveness of the web-based management interface itself. This vulnerab

CVE-2021-34706 [MEDIUM] CWE-611 CVE-2021-34706: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing

CVE-2025-20131 [MEDIUM] CWE-284 CVE-2025-20131: A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, rem A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload using the Cis

CVE-2019-15282 [MEDIUM] CWE-306 CVE-2019-15282: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Softwa A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by