CVE-2023-20196 describes two vulnerabilities in Cisco Identity Services Engine (ISE) that allow an authenticated, remote attacker to upload arbitrary files. These flaws stem from improper file validation in the web-based management interface, affecting Cisco ISE. The vulnerability has a CVSS score of 7.2 (High), indicating a significant risk. Exploitation requires valid Administrator credentials and could lead to storing malicious files, potentially enabling arbitrary code execution with root privileges. While the vulnerability is severe, there is currently no public exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not listed in CISA's KEV catalog. Community discussion and media coverage are minimal, suggesting limited public awareness or active exploitation at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:* | ||
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:* | ||
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:* | ||
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:* | ||
2.7.0CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.