Medium severity · published Jan 10, 2019
CVE-2018-15456
A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text
4.9
CVSS
1.3%
EPSS
No
On KEV
Description
A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text. The vulnerability is due to the incorrect inclusion of saved passwords when loading configuration pages in the Admin Portal. An attacker with read or write access to the Admin Portal could exploit this vulnerability by browsing to a page that contains sensitive data. An exploit could allow the attacker to recover passwords for unauthorized use and expose those accounts to further attack.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Identity Services Engine · Cisco
2.2(0.470); 2.3(0.298); 2.4(0.357); 2.4(100.159) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15456
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15456
Third Party Advisory
http://www.securityfocus.com/bid/106512
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ise-passwd
More from Identity Services Engine
10.0
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
10.0
CVE-2025-20337
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
10.0
CVE-2025-20281
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
10.0
CVE-2026-20130
Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities
10.0
CVE-2026-20192
Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities
