SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76433

MEDIUM(5.3)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Risk Signal Score23/100 — NIEDRIG
  • CVSS 5.3 — Mittel
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device. This vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects attempts to access files outside of the intended directory using directory traversal sequences in provisioning resource requests.

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "NetworkConnectionInitiated" or ActionType == "NetworkConnectionSuccessful"
| where RemotePort == 443 or RemotePort == 80 // Assuming web traffic to ISE
| where RemoteUrl contains "/provisioning/" and RemoteUrl contains "../" // Adjust path as per actual ISE provisioning URL structure
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine

Splunk SPL

index=web (uri_path="/provisioning/*" AND uri_path="../") OR (source="cisco_ise_logs" AND message="*provisioning*" AND message="*../*")
| table _time, host, src_ip, uri_path, user_agent

Sigma

title: Cisco ISE Directory Traversal Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects attempts to exploit directory traversal in Cisco ISE provisioning download feature.
author: SecBoard
date: 2026/09/16
logsource:
  category: webserver
  product: cisco_ise
detection:
  selection:
    url|contains: 
      - '/provisioning/'
      - '../'
  condition: selection
level: medium

Elastic ES|QL

FROM logs-cisco.ise-*
| WHERE url.path : "/provisioning/*" AND url.path : "../"
| SELECT @timestamp, host.name, source.ip, url.path, user_agent.original

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen