Command Injection Vulnerability in Cisco ISE Products

CVE-2023-20175

Summary

A command injection vulnerability exists in specific Cisco ISE CLI commands that may allow an authenticated attacker to execute arbitrary commands on the underlying operating system, potentially gaining root privileges. This security flaw arises from inadequate validation of user-supplied input. To successfully exploit this vulnerability, an attacker must possess valid Read-only-level privileges or higher on the affected device and can achieve this through specially crafted CLI commands. If successful, the attacker could gain elevated rights, leading to significant security risks.

References