Cisco ISE maximum severity flaw lets hackers execute root code

• Cisco patched a maximum-severity flaw impacting Identity Services Engine and ISE Passive Identity Connector
• The flaw allowed threat actors to run arbitrary code on the underlying OS
• It was patched in versions 3.3 and 3.4

A maximum-severity vulnerability was recently discovered, and patched, in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). This flaw allowed threat actors to execute arbitrary code, with elevated privileges, on the operating system of the devices running the tools.

ISE is a network security policy management and access control platform, helping organizations centrally manage who and what can connect to their network. The ISE-PIC, on the other hand, is a lightweight service that collects identity information about users and devices without requiring them to authenticate via traditional methods.