Cisco has published an advisory on authorization-bypass bugs in the web management interface of Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). An authenticated attacker with administrator credentials could change parts of the configuration, including file descriptions on specific pages, because the server didn’t fully check permissions. Cisco has released software updates. There are no workarounds. Cisco PSIRT says it isn’t aware of any malicious use.
What to do
- ISE 3.3: Patch 12.
- ISE 3.4: Patch 7.
- ISE 3.5: Patch 4.
- 3.2 and earlier: migrate to a fixed release. ISE-PIC is end-of-sale; 3.4 is the last supported release.
If you run ISE, apply the patch for your train. Don’t leave the management interface hanging off an untrusted network.
God Bless, and May the Source Be with You!
