Skip to content
fr Sign in
Not rated

CVE-2018-0214 A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local…

Description

A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection. These commands should have been restricted from this user. The vulnerability is due to insufficient input validation of CLI command user input. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a CLI command with crafted user input. A successful exploit could allow the attacker to execute arbitrary commands on the affected system that should be restricted. The attacker would need to have valid user credentials for the device. Cisco Bug IDs: CSCvf49844.

Affected products and versions

Product Affected versions Fixed in
Cisco Identity Services Engine Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Identity Services Engine

The 21 CVEs of Cisco Identity Services Engine →
CVE-2018-0289 A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote… Not rated CVE-2018-0277 A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation… Not rated CVE-2018-0327 A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote… Not rated CVE-2018-0275 A vulnerability in the support tunnel feature of Cisco Identity Services Engine (ISE) could allow an authenticated,… Not rated
Track this CVE