Medium severity · published Apr 5, 2023
CVE-2023-20152
Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the…
6.7
CVSS
0.4%
EPSS
No
On KEV
Description
Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Identity Services Engine · Cisco
3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20152
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20152
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-2XbOg9Dg
More from Identity Services Engine
10.0
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
10.0
CVE-2025-20337
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
10.0
CVE-2025-20281
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
10.0
CVE-2026-20130
Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities
10.0
CVE-2026-20192
Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities
