Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.

According to its self-reported version, Cisco Identity Services Engine is affected by multiple command injection vulnerabilities:

  - A vulnerability in the restricted shell of Cisco ISE could allow an authenticated, local attacker to escape     the restricted shell and gain root privileges on the underlying operating system. (CVE-2023-20121)

  - A vulnerability in the restricted shell of Cisco ISE could allow an authenticated, local attacker to escape   the restricted shell and gain root privileges on the underlying operating system. (CVE-2023-20122)


Please see the included Cisco BIDs and Cisco Security Advisory for more information.

A vulnerability in the restricted shell of Cisco EPNM could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system.

This vulnerability is due to improper validation of parameters that are sent to a certain CLI command within the restricted shell. An attacker could exploit this vulnerability by logging in to the device and issuing a certain crafted CLI command. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of the affected device. To exploit this vulnerability, the attacker must be an authenticated shell user.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, Cisco Prime Infrastructure Software is affected by a command injection vulnerability. This could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
179741	Cisco Identity Services Engine Command Injection Vulnerabilities (cisco-sa-adeos-MLAyEcvk)	Nessus	CISCO	high
179740	Cisco Evolved Programmable Network Manager Stored Command Injection (cisco-sa-adeos-MLAyEcvk)	Nessus	CISCO	medium
173975	Cisco Prime Infrastructure Command Injection (cisco-sa-adeos-MLAyEcvk)	Nessus	CISCO	medium

Detections

Analytics

CVE-2023-20121

medium

Tenable Plugins

high

medium

medium