Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2023-20175

A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on…

High8.8EPSS 0.52%
Published
Updated
Reserved
Assigned by
cisco

Description

A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid Read-only-level privileges or higher on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.

Scores

CVSS scores of CVE-2023-20175, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.1High8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Modified3.1High8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.52% · top 56% of all CVEs (4 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

Affected products

  • Cisco · Cisco Identity Services Engine Software

    • affected 2.6.0
    • affected 2.6.0 p1
    • affected 2.6.0 p2
    • affected 2.6.0 p3
    • affected 2.6.0 p5
    • affected 2.6.0 p6
    • affected 2.6.0 p7
    • affected 2.6.0 p8
    • affected 2.6.0 p9
    • affected 2.6.0 p10
    • affected 2.6.0 p11
    • affected 2.6.0 p12
    • affected 2.7.0
    • affected 2.7.0 p1
    • affected 2.7.0 p2
    • affected 2.7.0 p3
    • affected 2.7.0 p4
    • affected 2.7.0 p5
    • affected 2.7.0 p6
    • affected 2.7.0 p7
    • affected 2.7.0 p9
    • affected 3.0.0
    • affected 3.0.0 p1
    • affected 3.0.0 p2
    • affected 3.0.0 p3
    • affected 3.0.0 p4
    • affected 3.0.0 p5
    • affected 3.0.0 p6
    • affected 3.0.0 p7
    • affected 3.1.0
    • affected 3.1.0 p1
    • affected 3.1.0 p3
    • affected 3.1.0 p4
    • affected 3.1.0 p5
    • affected 3.2.0

What to do

Exploitation: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-20175 badge
[![CVE-2023-20175](https://trackcve.app/badge/CVE-2023-20175.svg)](https://trackcve.app/cve/CVE-2023-20175)

Record last updated .