CVE-2023-20170 is a command injection vulnerability in Cisco Identity Services Engine (ISE) that allows an authenticated, local attacker with Administrator-level privileges to execute arbitrary commands on the underlying operating system and achieve root privilege escalation. This vulnerability stems from insufficient validation of user-supplied input within a specific CLI command. The vulnerability has a CVSS score of 6.7 (Medium) and requires high privileges (PR:H) and local access (AV:L), but has high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). While not currently listed on CISA's KEV catalog, its EPSS score is very low, indicating a low probability of exploitation in the wild. There is no public exploit code available for this CVE, and it has received minimal community discussion and media coverage, suggesting limited current attention or active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.2CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:* | ||
3.2CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:3.2:patch1:*:*:*:*:*:* | ||
3.2CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:3.2:patch2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.