SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20306

CRITICAL(9.1)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score33/100 — MITTEL
  • CVSS 9.1 — Kritisch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "web-based management interface" and ProcessCommandLine contains "cmd.exe" or ProcessCommandLine contains "sh"
| where InitiatingProcessParentFileName contains "java" or InitiatingProcessParentFileName contains "tomcat" // Assuming typical web server processes
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath, InitiatingProcessParentFileName

Splunk SPL

index=* (sourcetype=cisco:ise OR sourcetype=ise:restapi) (command_injection OR "cmd.exe" OR "sh")
| search (http_user_agent=*web-based* OR http_referrer=*web-based*)
| table _time, host, source, user, action, command

Sigma

title: Cisco ISE REST API Command Injection
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential command injection attempts in Cisco ISE REST API via web-based management interface.
author: SecBoard
date: 2026/09/16
logsource:
  product: cisco
  service: ise
detection:
  selection:
    event_type: web_access
    url|contains: '/api/'
    http_method: POST
    body|contains:
      - 'cmd.exe'
      - 'sh'
      - 'powershell'
  condition: selection
level: high

Elastic ES|QL

from logs-cisco.ise.*
| where event.dataset == "ise.restapi" and http.request.method == "POST" and http.request.body.content : ("cmd.exe", "sh", "powershell")
| select @timestamp, host.name, user.name, http.request.method, http.request.url, http.request.body.content

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen