Multiple vulnerabilities have been discovered in the Cisco Services Engine associated with Arbitrary File Upload and Denial of Service. These vulnerabilities are assigned with CVEs CVE-2023-20195, CVE-2023-20196, and CVE-2023-20213. The severity of these vulnerabilities ranges between 4.3 (Medium) and 4.7 (Medium).
The Cisco Services Engine is a critical component of the Cisco Identity Services Engine, which is an identity and access control policy platform that helps enforce compliance, enhance infrastructure security, and streamline service operations. The vulnerabilities found in the Cisco Services Engine can potentially have a significant impact on the security and functionality of the system.
The CVE-2023-20195 and CVE-2023-20196 vulnerabilities allow an authenticated threat actor with valid Administrator credentials to upload arbitrary files to an affected device. These vulnerabilities exist due to the improper validation of files uploaded to the web-based management interface. This means that threat actors can abuse this vulnerability by uploading specially crafted files. The severity of these vulnerabilities is classified as 4.7 (Medium).
Additionally, the CVE-2023-20213 vulnerability affects the Cisco Discovery Protocol (CDP) processing feature of Cisco ISE. An authenticated threat actor can exploit this vulnerability to cause a denial of service (DoS) condition in the CDP process. Cisco CDP is used to identify which Cisco port is connected to a specific vSwitch, along with providing information about the software version and device ID of the Cisco switch. The severity of this vulnerability is classified as 4.3 (Medium).
To address these vulnerabilities, Cisco has released a security advisory and patches to fix the issues. It is strongly recommended that users of the affected products install these patches as soon as possible to mitigate the risk of exploitation.
The list of affected products and the corresponding fixed releases are as follows:
– For Cisco ISE Release 2.6 and earlier, users are advised to migrate to a fixed release.
– For Cisco ISE Release 2.7, the recommended fixed release for CVE-2023-20195 and CVE-2023-20196 is 2.7P10.
– For Cisco ISE Release 3, the recommended fixed release for CVE-2023-20195 and CVE-2023-20196 is 3.0P8, and for CVE-2023-20213 is 3.0P7.
– For Cisco ISE Release 3.1, the recommended fixed release for CVE-2023-20195 and CVE-2023-20196 is 3.1P8 (Nov 2023), and for CVE-2023-20213 is 3.1P6.
– For Cisco ISE Release 3.2, the recommended fixed release for CVE-2023-20195 and CVE-2023-20196 is 3.2P3, and for CVE-2023-20213 is 3.2P2.
– Cisco ISE Release 3.3 is not vulnerable to these identified vulnerabilities.
Users are strongly advised to update their affected Cisco ISE installations to the appropriate fixed release to ensure that these vulnerabilities are addressed and their systems are protected.
In conclusion, multiple vulnerabilities have been discovered in the Cisco Services Engine associated with Arbitrary File Upload and Denial of Service. Cisco has released patches and a security advisory to address these vulnerabilities. It is highly recommended that users of the affected products install the necessary patches to ensure the security and integrity of their systems.