Description
Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.3.0 | affected |
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.3 Patch 1 | affected |
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.3 Patch 2 | affected |
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.3 Patch 3 | affected |
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.3 Patch 4 | affected |
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.3 Patch 5 | affected |
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.3 Patch 6 | affected |
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.4.0 | affected |
| Cisco Identity Services Engine Software | Cisco / Cisco Identity Services Engine Software | 3.4 Patch 1 | affected |
| Cisco ISE Passive Identity Connector | Cisco / Cisco ISE Passive Identity Connector | 3.1.0 | affected |
| Cisco ISE Passive Identity Connector | Cisco / Cisco ISE Passive Identity Connector | 3.2.0 | affected |
| Cisco ISE Passive Identity Connector | Cisco / Cisco ISE Passive Identity Connector | 3.3.0 | affected |
| Cisco ISE Passive Identity Connector | Cisco / Cisco ISE Passive Identity Connector | 3.4.0 | affected |