Cisco ISE and ISE-PIC Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This vulnerability allows an authenticated, remote attacker to read arbitrary files from the underlying operating system of the affected device. The issue arises from improper validation of user-supplied input, enabling attackers to exploit it by sending crafted HTTP requests. Successful exploitation could grant access to sensitive files on the system.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the affected system.

Remediation

Cisco has released software updates to address this vulnerability. For instructions on upgrading, refer to the Upgrade Guides on the Cisco Identity Service Engine support page. Customers should contact the Cisco Technical Assistance Center (TAC) for upgrade assistance if needed.