SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20352

HIGH(8.6)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Risk Signal Score32/100 — MITTEL
  • CVSS 8.6 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a crafted RADIUS request directly to an affected device. A successful exploit could allow the attacker to cause the ISE node to become unavailable. For single node deployments in that condition, endpoints that have not already authenticated would be unable to access the network until the node comes back up on its own.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

let radius_dos_keywords = dynamic(['RADIUS request', 'crafted RADIUS request', 'improper handling of certain RADIUS requests']);
SecurityEvent
| where EventID == 5156 // Example: Windows Filtering Platform connection
| where ProcessName has "radius" or CommandLine has "radius"
| where InitiatingProcessCommandLine has_any (radius_dos_keywords)
| project TimeGenerated, Computer, ProcessName, CommandLine, InitiatingProcessCommandLine, EventID

Splunk SPL

(sourcetype=cisco:ise OR sourcetype=radius) (radius_request OR "crafted RADIUS request" OR "improper handling of certain RADIUS requests")
| stats count by host, source, _time
| sort -count

Sigma

title: Cisco ISE RADIUS DoS Attempt
logsource:
  product: cisco
  service: ise
detection:
  keywords:
    - 'RADIUS request'
    - 'crafted RADIUS request'
    - 'improper handling of certain RADIUS requests'
  condition: keywords
level: high

Elastic ES|QL

from cisco.ise.logs or radius.logs
| where message : "RADIUS request" or message : "crafted RADIUS request" or message : "improper handling of certain RADIUS requests"
| stats count() by host.name, @timestamp
| sort @timestamp desc

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen