Cisco ISE Vulnerability Allows Arbitrary File Upload and RootElevation

CVE-2024-20296

What is CVE-2024-20296?

A vulnerability exists in the web-based management interface of Cisco Identity Services Engine that allows an authenticated remote attacker to upload arbitrary files. This flaw arises from inadequate validation of uploaded files. An attacker with valid Policy Admin credentials can exploit this vulnerability to store malicious files on the device. If successful, this could lead to the execution of arbitrary commands on the operating system and potentially escalate privileges to root, compromising the security of the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References