Command Injection Vulnerability in Cisco Identity Services Engine (ISE)

CVE-2023-20170

What is CVE-2023-20170?

A vulnerability exists in Cisco Identity Services Engine that could allow an authenticated, local attacker to execute command injection attacks. This security flaw arises from insufficient input validation in the CLI commands, allowing an attacker with valid Administrator-level privileges to submit a specially crafted command. Exploiting this vulnerability could permit the attacker to elevate their privileges to root, thereby gaining unauthorized access to critical system components.

References