Cisco ISE Vulnerability: Arbitrary Actions Possible via CSRF

CVE-2024-20486

Summary

A security vulnerability in the management interface of Cisco Identity Services Engine (ISE) allows unauthenticated remote attackers to execute CSRF attacks. This exploit hinges on insufficient CSRF protections, enabling attackers to manipulate the device by coercing a user into clicking a specially crafted link. Through successful exploitation, an attacker can execute arbitrary actions on the device as if they were the legitimate user, posing significant risks to data integrity and security.

References