CVE-2023-20195 describes two critical vulnerabilities in Cisco Identity Services Engine (ISE) that allow an authenticated, remote attacker with Administrator credentials to upload arbitrary files. These flaws stem from improper file validation in the web-based management interface, enabling the storage of malicious files. A successful exploit could lead to arbitrary code execution with root privileges on the affected device. While rated High severity (CVSS 7.2), there is currently no public exploit code available, nor is it known to be actively exploited. Community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:* | ||
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:* | ||
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:* | ||
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:* | ||
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.