CVE-2023-20273: Cisco IOS XE Web UI Command Injection Vulnerability

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)92.9% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Oct 23, 2023

Federal remediation dueOct 27, 2023

Ransomware campaign useNot known

Affected products

Which versions

IX

IOS XE · Cisco

16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1a; +34 more · source: NVD

CI

Cisco IOS XE Software · Cisco

16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; +34 more · source: vendor

CI

Cisco IOS XE Web UI · Cisco

All versions, or not specified · source: KEV