Cisco Identity Services Engine Insecure Java Deserialization Vulnerability Allowing Arbitrary Command Execution

A vulnerability exists in an API of Cisco Identity Services Engine (ISE) due to insecure deserialization of user-supplied Java byte streams. This vulnerability could allow an authenticated, remote attacker with read-only administrative credentials to execute arbitrary commands as the root user on the affected device. Exploitation involves sending a crafted serialized Java object to the vulnerable API. In single-node deployments, new devices may fail to authenticate during the reload period.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution with root privileges on the affected device.

Remediation

Cisco has released software updates that address this vulnerability. Customers with service contracts should obtain these updates through their usual channels. For instructions on upgrading, refer to the Cisco Identity Services Engine support page.