Medium severity · published Jan 23, 2019
CVE-2018-0187
Cisco Identity Services Engine Privileged Account Sensitive Information Disclosure Vulnerability
6.5
CVSS
1.5%
EPSS
No
On KEV
Description
A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confidential information for privileged accounts. The vulnerability is due to the improper handling of confidential information. An attacker could exploit this vulnerability by logging into the web interface on a vulnerable system. An exploit could allow an attacker to obtain confidential information for privileged accounts. This information could then be used to impersonate or negatively impact the privileged account on the affected system.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cisco Identity Services Engine Software · Cisco
All versions, or not specified · source: vendor
IS
Identity Services Engine · Cisco
2.4(0.901); 2.4(0.901.1) · source: NVD
Affected product
CI
Cisco Identity Services Engine Software
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-0187
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-0187
Third Party Advisory
http://www.securityfocus.com/bid/106717
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-ise-info-disclosure
More from Cisco Identity Services Engine Software
10.0
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
10.0
CVE-2025-20337
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
10.0
CVE-2025-20281
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
10.0
CVE-2026-76423
Cisco ISE API Authentication Bypass Vulnerability
10.0
CVE-2026-20130
Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities
