Identity Services Engine vulnerabilities
42 known vulnerabilities in Identity Services Engine from Cisco. 42 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 10.0 Critical severity
Cisco Identity Services Engine Incorrect Use of Privileged APIs Exploited
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vuln
- 7.6 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into
- 7.2 High severity
Cisco Identity Services Engine Software: Relative Path Traversal
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerab
- 10.0 Critical severity
Cisco Identity Services Engine Software: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review
- 10.0 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review
- 9.9 Critical severity
Cisco Identity Services Engine Software: Insufficiently Protected Credentials
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review
- 7.5 High severity
Cisco Identity Services Engine Software: Improper Authorization
A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credential
- 9.9 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in a Command
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read On
- 9.9 Critical severity
Cisco Identity Services Engine Software: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read On
- 9.9 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in a Command
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative cred
- 7.5 High severity
Cisco Identity Services Engine Software: Incorrect Comparison
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a
- 10.0 Critical severity
Cisco Identity Services Engine Injection Exploited
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerabi
- 7.2 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An
- 7.2 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An
- 10.0 Critical severity
Cisco Identity Services Engine Software: Improper Privilege Management
A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due
- 10.0 Critical severity
Cisco Identity Services Engine Injection Exploited
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerabi
- 9.8 Critical severity
Cisco Identity Services Engine Software: Use of Hard-coded Password
A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrat
- 7.2 High severity
Cisco Identity Services Engine Software: Unrestricted Upload of File with Dangerous Type
A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due
- 8.6 High severity
Cisco Identity Services Engine Software: Out-of-bounds Read
A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling
- 7.2 High severity
Cisco Identity Services Engine Software: Missing Authorization
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node. This vulnerability is due to a lack of authorization in a s
- 7.2 High severity
Cisco Identity Services Engine Software: Deserialization of Untrusted Data
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected
- 7.2 High severity
Cisco Identity Services Engine Software: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system of an affected device. To exploit this vulnerability, an attacker would need valid Super Admin
- 8.8 High severity
Cisco Identity Services Engine Software: Cross-Site Request Forgery
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulner
- 8.1 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an SQL Command
Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection attacks. These vulnerabilities are due to insufficient validation of user-supplied input in REST API c
- 7.2 High severity
Cisco Identity Services Engine Software: Unrestricted Upload of File with Dangerous Type
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Po
- 8.8 High severity
Cisco Identity Services Engine Software: Cross-Site Request Forgery
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulner
- 8.8 High severity
Cisco Identity Services Engine Software: Improper Protection of Alternate Path
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation.
- 7.2 High severity
Cisco Identity Services Engine Software: Unrestricted Upload of File with Dangerous Type
Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. These vulnerabilitie
- 8.8 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid
- 7.2 High severity
Cisco Identity Services Engine Software: Unrestricted Upload of File with Dangerous Type
Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. These vulnerabilitie
- 8.6 High severity
Cisco Identity Services Engine Software: Improper Handling of Exceptional Conditions
A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS packets. This vulnerability is due to improper handling of c
- 7.2 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must ha
- 7.2 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must ha
- 7.8 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to escape the restricted shell and gain roo
- 8.8 High severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user inpu
- 8.8 High severity
Cisco Identity Services Engine Software: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This vulnerability is due to insufficient input val
- 8.8 High severity
Cisco Identity Services Engine Software: Cross-Site Request Forgery
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulner
- 8.8 High severity
Cisco Identity Services Engine Software: Incorrect Use of Privileged APIs
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access system files. This vulnerability is due to improper access control in the web-based m
- 8.1 High severity
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE)…
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied in