SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20282

MEDIUM(4.9)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Risk Signal Score17/100 — NIEDRIG
  • CVSS 4.9 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

4.9

Technische Schwere

Beschreibung

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain write access to the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials. Note: For CVE-2026-20282, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "HTTP request" and InitiatingProcessParentFileName contains "Cisco ISE" and ProcessCommandLine contains "write access"
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath

Splunk SPL

sourcetype=cisco:ise (http_request AND "write access") | table _time, host, process, command

Sigma

title: Cisco ISE Write Access via HTTP Request
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection:
    ParentImage|endswith: '\Cisco ISE\bin\ise.exe'
    CommandLine|contains: 'HTTP request'
    CommandLine|contains: 'write access'
  condition: selection
level: high

Elastic ES|QL

from process where process.parent.executable : "*Cisco ISE*" and process.command_line : "*HTTP request*" and process.command_line : "*write access*" | select @timestamp, host.name, process.parent.executable, process.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen