جزئیات آسیب‌پذیری
CVE-2026-76425
Cisco Identity Services Engine Software
Cisco ISE SQL Injection Vulnerability
CVSS 3.1
7.6بالا
شرح رسمی (انگلیسی)
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.6بالا | 3.1 | CVEProject cvelistV5 (CNA) (cisco) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Cisco | Cisco Identity Services Engine Software | 3.1.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p10 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p11 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p5 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p6 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p7 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p72 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p8 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.1.0 p9 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2 Patch 10 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2 Patch 8 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2 Patch 9 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2.0 p1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2.0 p2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2.0 p3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2.0 p4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2.0 p5 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2.0 p6 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.2.0 p7 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 10 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 11 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 12 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 5 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 6 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 7 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 8 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3 Patch 9 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.3.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.4 Patch 1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.4 Patch 2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.4 Patch 3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.4 Patch 4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.4 Patch 5 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.4 Patch 6 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.4.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.5 Patch 1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.5 Patch 2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.5 Patch 3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco Identity Services Engine Software | 3.5.0 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱
کانال تلگرام کُلون @kolunsec_fa
تازه‌های KEV، خبرهای مهم و خلاصه‌ی روزانه
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۶/۲۵
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۲۶
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- cisco
پیش‌بینی بهره‌برداری (EPSS)
۰٫۴٪
احتمال بهره‌برداری در ۳۰ روز
۳۵٫۱٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')