CVE-2023-20173: medium-severity vulnerability in Cisco Identity Services Engine Software
Cisco Identity Services Engine XML External Entity Injection Vulnerabilities
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.9epss 0.8%
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
Cisco · Cisco Identity Services Engine SoftwareRelated CVEs — Cisco Identity Services Engine Software
In the same product, most dangerous first.
CVE-2025-20281CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 97.6%KEVCVE-2026-76460CRITICALCisco Identity Services Engine Authentication Bypass VulnerabilityEPSS 75.6%KEVCVE-2025-20337CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 74.5%KEVCVE-2025-20282CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 38.7%CVE-2022-20964MEDIUMCVE-2022-20964EPSS 30.6%CVE-2022-20966MEDIUMCVE-2022-20966EPSS 27.6%