CVE-2023-20194
Cisco Identity Services Engine ≤ 2.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-20194 is a medium-severity Privilege Chaining (CWE-268) vulnerability in Cisco Identity Services Engine. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-24373
Vulnerability Data
A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on…
more
the affected device. This vulnerability is due to improper privilege management in the ERS API. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to elevate their privileges beyond the sphere of their intended access level, which would allow them to obtain sensitive information from the underlying operating system. Note: The ERS is not enabled by default. To verify the status of the ERS API in the Admin GUI, choose Administration > Settings > API Settings > API Service Settings.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 5 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Enforces proper privilege management by requiring all decisions through the verified reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege policy definition and enforcement directly limits unsafe privilege combinations while the control also addresses broader policy lifecycle activities.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control policies can limit the combination of privileges that enable unsafe actions.
A.5.18's provisioning, review, SoD, and revocation steps (esp. c, f, i) directly block unsafe privilege/role combinations at assignment and change time, but leave a bounded remainder (e.g. runtime dynamic chaining, combinations arising from un-reviewed legacy rights, or non-identity-based privilege escalation) unaddressed by this clause alone.
Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.
A.5.3 directly requires determining and enforcing segregation of the very duties/roles whose unsafe combination is CWE-268, so well-implemented segregation stops the chained privilege from being exercisable; the bounded remainder is small organizations or sanctioned exceptions where segregation cannot be achieved and the clause itself falls back to monitoring/supervision instead.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. blocks CWE-268
Ubuntu 24.04 (1 rule)
- V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. blocks CWE-268
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. blocks CWE-268
Windows Server 2016 (1 rule)
- V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. blocks CWE-268
Windows Server 2019 (1 rule)
- V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. blocks CWE-268