PT-2018-8676 · Cisco · Cisco Identity Services Engine

Published 2018-03-08 · Updated 2020-09-04 · CVE-2018-0214

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine (ISE) (affected versions not specified)

Description: A command injection issue exists due to insufficient input validation of CLI command user input, allowing an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user. The attacker must have valid user credentials for the device and could exploit this by issuing a CLI command with crafted user input.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2018-0214

Affected Products

Cisco Identity Services Engine

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0214 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0214 · Vendor Advisory
• http://securityfocus.com/bid/103331 · Note
• http://securitytracker.com/id/1040471 · Note