AI analysis
Cisco ISE and Cisco ISE-PIC contain a SQL injection flaw (CWE-89) in their REST APIs, where certain parameters are concatenated directly into SQL clauses without parameterization. An authenticated remote attacker who already holds valid administrative credentials can send a crafted request containing SQL statements in one of the affected parameters. A successful exploit allows the attacker to read information from the session database, with no integrity or availability impact, which is why the CVSS 3.1 score is a moderate 4.9 despite network reachability. All organizations running affected Cisco ISE or ISE-PIC releases are potentially affected, though exploitation requires high-privilege access. No public proof-of-concept or confirmed exploitation of this specific SQL injection is known, but Cisco ISE is drawing attacker attention because a separate ISE authentication-bypass zero-day (CVSS 10.0) is reportedly being exploited in active attacks.
What to do: Update ISE and ISE-PIC to the fixed releases identified in Cisco's security advisory once published, since no workaround details are available in the data. Restrict access to the ISE REST APIs to trusted administrative networks and hosts, and review which accounts hold administrative credentials. Given a separate ISE auth-bypass zero-day is under active exploitation, monitor Cisco PSIRT channels and authentication/API logs for anomalous activity closely.
Affected
| Cisco Identity Services Engine (ISE) | — |
| Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) | — |
Estimated exposure
large≈tens of thousands of enterprise deployments of Cisco ISE/ISE-PIC worldwide (no public scan data for this product) — Cisco ISE is one of the most widely deployed enterprise network access control (NAC) platforms, with an install base plausibly in the tens of thousands of organizations, though actual exposure is limited by the requirement for valid admin…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the session database. To exploit this vulnerability, the attacker must have valid administrative credentials.