CVE-2023-20243

CVE-2023-20243 is a vulnerability in Cisco Identity Services Engine (ISE) that allows an unauthenticated, remote attacker to disrupt RADIUS message processing. This denial-of-service vulnerability, rated 8.6 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), stems from improper handling of crafted RADIUS accounting requests. An attacker can exploit this by sending a malicious request directly if the RADIUS shared secret is known, or indirectly via a Network Access Device (NAD). A successful exploit causes the RADIUS process to restart, leading to authentication and authorization timeouts, potentially requiring manual intervention to restore service. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered some community discussion and media coverage.