CVE-2023-20171: Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-18 · updated 2026-06-17
Weakness: CWE-602

Description

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

Cisco Identity Services Engine: 3.1, 3.1-patch1, 3.1-patch3, 3.1-patch4, 3.1-patch5, 3.2 (+1)

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-delete-read-PK5ghDDd
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-delete-read-PK5ghDDd

Get alerted when CVE-2023-20171 or the next vulnerability affects your stack