PT-2018-8682 · Cisco · Cisco Identity Services Engine

Published 2018-03-08 · Updated 2019-10-09 · CVE-2018-0221

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine (ISE) (affected versions not specified)

Description: A vulnerability exists due to incomplete input validation of user input for certain CLI ISE configuration commands, allowing an authenticated, local attacker with valid administrator credentials to perform command injection to the underlying operating system or cause a hang or disconnect of the user session. The attacker can exploit this by issuing a specific CLI command and entering crafted, malicious user input for the command parameters, potentially allowing command injection to the lower-level Linux operating system or causing the ISE user interface to hang or disconnect.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-0221

Affected Products

Cisco Identity Services Engine

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0221 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0221 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise6 · Vendor Advisory
• http://securityfocus.com/bid/103347 · Note
• http://securitytracker.com/id/1040471 · Note