PT-2022-2109 · Cisco · Cisco Identity Services Engine

Published 2022-03-02 · Updated 2022-04-14 · CVE-2022-20756

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) (affected versions not specified)

Description A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS packets. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by attempting to authenticate to a network or a service where the access server is using Cisco ISE as the RADIUS server. A successful exploit could allow the attacker to cause Cisco ISE to stop processing RADIUS requests, causing authentication/authorization timeouts, which would then result in legitimate requests being denied access.

Recommendations To recover the ability to process RADIUS packets, a manual restart of the affected Policy Service Node (PSN) is required. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2022-01940

CVE-2022-20756

Affected Products

Cisco Identity Services Engine

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-20756 · Security Note
• https://bdu.fstec.ru/vul/2022-01940 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20756 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-dos-JLh9TxBp · Vendor Advisory
• https://cisco.com/c/en/us/support/docs/csa/cisco-sa-ise-dos-JLh9TxBp.html?dtid=osscdc000283 · Vendor Advisory
• https://t.me/cibsecurity/40254 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022030220 · Note
• https://t.me/true_secator/2693 · Telegram Post
• https://t.me/cvenotify/28545 · Telegram Post