Cisco Identity Services Engine Privilege Escalation Vulnerability [CVE-2021-1594]

CVE number – CVE-2021-1594

A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a command injection attack and elevate privileges to root.

This vulnerability is due to insufficient input validation for specific API endpoints. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting and modifying specific internode communications from one ISE persona to another ISE persona. A successful exploit could allow the attacker to run arbitrary commands with root privileges on the underlying operating system. To exploit this vulnerability, the attacker would need to decrypt HTTPS traffic between two ISE personas that are located on separate nodes.

This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco ISE in a distributed deployment.

Determine the Deployment Type

To determine whether Cisco ISE is in a distributed deployment on a device, do the following:

• For a device running Cisco ISE Release 3.0 or later, go to the Cisco ISE GUI and click the Menu icon. (This step is not necessary for devices running a release earlier than Release 3.0.)
• Choose Administration > System > Deployment.
• Click Deployment from the navigation pane on the left to see all of the Cisco ISE nodes that are part of the deployment.

If the value under Role(s) is STANDALONE, the device is in a standalone deployment and is not affected by this vulnerability. If there is any value other than STANDALONE under Role(s), the device is in a distributed deployment and is affected by this vulnerability.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-UwqPrBM3