What happened
A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.
Affected versions
Cisco Identity Services Engine Software: 3.4.0; 3.4 Patch 1; 3.4 Patch 2; 3.4 Patch 3; 3.5.0; 3.4 Patch 4; 3.5 Patch 1; 3.4 Patch 5; 3.5 Patch 2 Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.