Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2017-12261

Опубликовано: 02 нояб. 2017
Источник: nvd
CVSS3: 7.8
CVSS2: 7.2
EPSS Низкий

Описание

A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI commands issued at the restricted shell. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. An attacker would need valid user credentials to the device to exploit this vulnerability. The vulnerability affects the following Cisco Identity Services Engine (ISE) products running Release 1.4, 2.0, 2.0.1, 2.1.0: ISE, ISE Express, ISE Virtual Appliance. Cisco Bug IDs: CSCve74916.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:identity_services_engine:1.4:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.1.0:*:*:*:*:*:*:*
Конфигурация 2

Одно из

cpe:2.3:a:cisco:identity_services_engine_express:1.4:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_express:2.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_express:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_express:2.1.0:*:*:*:*:*:*:*
Конфигурация 3

Одно из

cpe:2.3:a:cisco:identity_services_engine_virtual_appliance:1.4:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_virtual_appliance:2.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_virtual_appliance:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_virtual_appliance:2.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 14%
0.00046
Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-264
CWE-863

Связанные уязвимости

github логотип

GHSA-vfpm-r25x-9hg6

CVSS3: 7.8
github
больше 3 лет назад

A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI commands issued at the restricted shell. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. An attacker would need valid user credentials to the device to exploit this vulnerability. The vulnerability affects the following Cisco Identity Services Engine (ISE) products running Release 1.4, 2.0, 2.0.1, 2.1.0: ISE, ISE Express, ISE Virtual Appliance. Cisco Bug IDs: CSCve74916.

fstec логотип

BDU:2018-00195

CVSS3: 7.8
fstec
больше 8 лет назад

Уязвимость командной оболочки платформы управления политиками соединений Cisco Identity Services Engine (ISE), позволяющая нарушителю выполнить произвольные команды с расширенными привилегиями

EPSS

Процентиль: 14%
0.00046
Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-264
CWE-863