Víctor Campos

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (ISE) (affected versions not specified) **Description** A vulnerability in the Localdisk Management feature could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This issue is due to insufficient input validation, allowing an attacker to exploit it by sending a crafted HTTP request with absolute path sequences. A successful exploit could allow the attacker to upload malicious files to arbitrary locations within the file system, potentially accessing the underlying operating system and executing commands with system privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (ISE) (affected versions not specified) **Description** A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This issue is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this by persuading a user to follow a crafted link, potentially allowing the attacker to perform arbitrary actions with the privileges of the target user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (ISE) (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This issue is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this by injecting malicious code into specific pages of the interface, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information. **Recommendations** To resolve this issue, update the Cisco Identity Services Engine (ISE) to a version that includes the fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.