Executive Summary

This vulnerability exists in the RADIUS Policy API endpoints of Cisco ISE. It allows an authenticated remote attacker who has read-only Administrator privileges to bypass role-based access controls and gain unauthorized read access to sensitive RADIUS Policy information.

The issue arises because the RADIUS Policy API endpoints do not properly enforce role-based access control permissions, enabling attackers to bypass the web-based management interface and directly call the vulnerable endpoints.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated attacker with read-only Administrator privileges to gain unauthorized read access to sensitive RADIUS Policy details by bypassing role-based access control (RBAC).

Unauthorized access to sensitive information could potentially lead to non-compliance with standards and regulations such as GDPR and HIPAA, which require strict controls on access to sensitive data.

However, the provided information does not explicitly describe the direct impact on compliance with these standards or any regulatory consequences.

Useful 0 Not Useful 0

Detection Guidance

There are no specific detection commands or methods provided to identify exploitation of this vulnerability on your network or system.

Since the vulnerability involves bypassing role-based access control by directly calling RADIUS Policy API endpoints, monitoring for unusual or unauthorized API calls to these endpoints could help detect potential exploitation.

However, no explicit detection commands or tools are mentioned in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to apply the software updates released by Cisco that fix this vulnerability.

• Upgrade affected Cisco ISE versions to fixed releases: 3.3 Patch 11, 3.4 Patch 6, or 3.5 Patch 3.
• Alternatively, upgrade to version 3.6 or later, which is not vulnerable.

There are no available workarounds for this vulnerability, so timely patching is critical.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability could gain unauthorized access to sensitive RADIUS Policy details that should be restricted based on their role.

This unauthorized access could lead to exposure of sensitive configuration information, potentially aiding further attacks or misuse of network authentication policies.

Useful 0 Not Useful 0