PT-2024-18675 · Cisco · Cisco Ise

Pear1Y · Published 2024-11-06 · Updated 2024-11-06 · CVE-2024-20528

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco ISE (affected versions not specified)

Description A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system of an affected device. This is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device, potentially allowing them to upload custom files to arbitrary locations, execute arbitrary code, and elevate privileges to root. The attacker would need valid Super Admin credentials to exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-02183

CVE-2024-20528

Affected Products

Cisco Ise

References · 8

• https://osv.dev/vulnerability/CVE-2024-20528 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02183 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-BBRf7mkE · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20528 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy · Vendor Advisory
• https://twitter.com/CVEnew/status/1854203364151623902 · Twitter Post
• https://t.me/cvedetector/10028 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1854268293491695680 · Twitter Post