CVE-2024-20486: Cisco Identity Services Engine CSRF Flaw

CVE-2024-20486 Overview

CVE-2024-20486 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the web-based management interface of Cisco Identity Services Engine (ISE). An unauthenticated, remote attacker can perform arbitrary actions on an affected device by persuading an authenticated user to follow a crafted link. Successful exploitation grants the attacker the privileges of the targeted user, which may include administrative access to the network access control platform.

The flaw stems from insufficient CSRF protections in the web management interface. Cisco published the advisory on August 21, 2024, covering ISE versions 3.1, 3.2, and 3.3.

Critical Impact
Successful exploitation allows attackers to perform arbitrary administrative actions on Cisco ISE, potentially compromising network access control policies, user authentication workflows, and downstream network infrastructure.

Affected Products

Cisco Identity Services Engine 3.1 (including patches 1–8)
Cisco Identity Services Engine 3.2 (including patches 1–6)
Cisco Identity Services Engine 3.3 (including patches 1–2)

Discovery Timeline

2024-08-21 - Cisco publishes security advisory cisco-sa-ise-csrf-y4ZUz5Rj
2024-08-21 - CVE-2024-20486 published to NVD
2025-03-31 - Last updated in NVD database

Technical Details for CVE-2024-20486

Vulnerability Analysis

Cisco Identity Services Engine is a policy management and network access control platform deployed at the core of enterprise networks. The web-based management interface accepts state-changing requests without validating whether the request originated from a legitimate, intentional user action. This omission is the defining characteristic of a CSRF vulnerability [CWE-352].

An attacker who can lure an authenticated administrator to a malicious page can have the victim's browser submit forged requests to the ISE management interface. The forged requests execute with the victim's session privileges. Because the attack requires user interaction and operates over the network, exploitation is feasible against any administrator with active session cookies.

Root Cause

The root cause is the absence or inadequacy of anti-CSRF tokens, SameSite cookie controls, or origin validation on sensitive endpoints within the ISE management interface. Without per-request unpredictable tokens tied to the user session, the application cannot distinguish requests initiated by the legitimate UI from cross-origin requests triggered by a malicious page.

Attack Vector

Exploitation requires the attacker to deliver a crafted link or web page to a user who is currently authenticated to the ISE web interface. The malicious page issues HTTP requests, often through hidden forms, image tags, or JavaScript, that target ISE endpoints performing privileged actions. Common attack delivery channels include phishing emails, malicious advertisements, and compromised internal sites.

No authentication credentials, exploit code, or technical proof-of-concept have been published. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been confirmed.

Detection Methods for CVE-2024-20486

Indicators of Compromise

Unexpected configuration changes in Cisco ISE policies, user accounts, or network device entries that do not correlate with planned administrator activity.
HTTP requests to ISE administrative endpoints with Referer or Origin headers pointing to external or unexpected domains.
Administrator session activity originating from browsers that recently visited untrusted external sites.

Detection Strategies

Monitor ISE audit logs for state-changing API calls correlated with web sessions that have anomalous referrer or origin metadata.
Inspect web proxy and EDR telemetry for ISE administrators visiting external URLs immediately preceding configuration changes.
Alert on bursts of administrative actions performed within a single short session window, which can indicate scripted CSRF payload execution.

Monitoring Recommendations

Forward ISE administrative audit logs to a centralized SIEM and build detections for high-risk policy modifications.
Track ISE administrator account activity for off-hours configuration changes and changes performed without a corresponding change ticket.
Review browser and email security telemetry for delivery of links targeting internal ISE management URLs.

How to Mitigate CVE-2024-20486

Immediate Actions Required

Upgrade Cisco ISE to a fixed release as identified in Cisco advisory cisco-sa-ise-csrf-y4ZUz5Rj.
Restrict access to the ISE web-based management interface to dedicated administrative networks or jump hosts using firewall and ACL controls.
Require administrators to use isolated browsers or dedicated workstations for ISE management, separate from general web browsing and email.

Patch Information

Cisco has released software updates that address this vulnerability. Customers should consult the Cisco Security Advisory for the specific fixed release matching their deployed ISE train. There are no workarounds that address this vulnerability according to Cisco.

Workarounds

Enforce short administrative session timeouts to reduce the window in which a user holds a valid session cookie.
Require administrators to log out of the ISE interface immediately after completing tasks and avoid browsing other sites in the same browser profile.
Apply browser-level controls such as strict SameSite cookie policies and block known malicious domains via DNS or web proxy filtering.

bash

# Configuration example: restrict ISE admin interface access via upstream ACL
# Replace 10.10.10.0/24 with your administrative subnet and ise.example.com with your ISE host
access-list ISE-ADMIN permit tcp 10.10.10.0 0.0.0.255 host <ISE_ADMIN_IP> eq 443
access-list ISE-ADMIN deny   tcp any host <ISE_ADMIN_IP> eq 443
access-list ISE-ADMIN permit ip any any