Cisco Fixes a Wide Range of Vulnerabilities in ISE, Including an Already Exploited Flaw

Cisco has released a major security update for Identity Services Engine and ISE Passive Identity Connector, fixing numerous vulnerabilities, including authentication bypass, remote code execution, command injection, SQL injection, and access to sensitive information. A critical vulnerability in an API endpoint allows an unauthenticated remote attacker to bypass the management interface, and Cisco says that at least one of the flaws included in the update has already been actively exploited. Other issues allow compromised administrators to execute commands as root, manipulate databases, or retrieve hashed credentials. The update also addresses RADIUS, path traversal, XSS, and 802.1X session hijacking vulnerabilities, with potential consequences for availability and network access control. Cisco has released fixed versions, but workarounds are unavailable for most of the issues. Given ISE's central role in identity management and device admission to corporate networks, organizations should update immediately and investigate any anomalous access to APIs and administrative consoles.

Source: Cisco Security Advisories