Cisco Identity Services Engine RADIUS Policy API Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the RADIUS Policy API endpoints of Cisco Identity Services Engine (ISE). This vulnerability allows an authenticated, remote attacker with read-only Administrator privileges to gain unauthorized access to sensitive RADIUS Policy information on the affected device. The issue arises from improper role-based access control (RBAC) permissions, enabling attackers to bypass the web-based management interface and directly call the vulnerable API endpoints.

Impact

Exploitation of this vulnerability could lead to unauthorized read access to sensitive RADIUS Policy details that are normally restricted based on the user's role.

Remediation

Users can upgrade to Cisco ISE version 3.3 Patch 11, 3.4 Patch 6, or 3.5 Patch 3. For versions 3.2 and earlier, migrating to a fixed release is recommended.