SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20305

CRITICAL(9.1)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score33/100 — MITTEL
  • CVSS 9.1 — Kritisch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects attempts to execute arbitrary commands via the web-based management interface of Cisco ISE/ISE-PIC, specifically targeting diagnostic tools. Requires logging of administrative web interface interactions and command executions.

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4688 and NewProcessName contains "sh" or NewProcessName contains "bash" or NewProcessName contains "cmd.exe"
| where ParentProcessName contains "httpd" or ParentProcessName contains "tomcat"
| where CommandLine contains "diagnostic" or CommandLine contains "tool"
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName

Splunk SPL

index=cisco_ise sourcetype=ise_logs (process="sh" OR process="bash" OR process="cmd.exe") (parent_process="httpd" OR parent_process="tomcat") (commandline="*diagnostic*" OR commandline="*tool*")

Sigma

title: Cisco ISE Diagnostic Command Injection
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith: ['/usr/sbin/httpd', '/opt/apache-tomcat/bin/tomcat']
    Image|endswith: ['/bin/sh', '/bin/bash', '/bin/cmd.exe']
    CommandLine|contains: ['diagnostic', 'tool']
  condition: selection
level: critical

Elastic ES|QL

from process where process.parent.name in ("httpd", "tomcat") and process.name in ("sh", "bash", "cmd.exe") and process.command_line : ("*diagnostic*", "*tool*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen