This vulnerability involves improper encoding or escaping of output in the CLI of Cisco Identity Services Engine and its Passive Identity Connector. An authenticated local attacker with administrative privileges can exploit insufficient input validation in a CLI command to inject commands on the underlying OS, resulting in privilege escalation to root. The issue affects a broad range of Cisco ISE versions from 3.1.0 through 3.5 Patch 2. The CVSS 3.1 base score is 6.0, indicating a medium severity with local attack vector, low attack complexity, and high impact on confidentiality and integrity but no impact on availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation allows an authenticated local attacker with administrative privileges to escalate their privileges to root on the underlying operating system. This can lead to full control over the affected system, compromising confidentiality and integrity of data. Availability is not impacted. The vulnerability requires local access and administrative privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for any unusual activity. Do not rely on generic mitigations as this vulnerability specifically involves command injection via CLI input validation.