Auth bypass in Cisco Identity Services Engine Software

CVE-2013-5531

Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted session on TCP port 443, aka Bug ID CSCty20405.

Vulnerability class: Broken Authentication

EPSS: 0.013 (68.4th percentile) — read the EPSS interpretation.

Affected products

Cisco Identity_services_engine_software — versions 1.0, 1.1
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)