CVE-2023-20273
Cisco IOS XE Web UI Command Injection Vulnerability
This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Cisco IOS XE Web UI, fix it now.
CISA required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
US federal civilian agencies must remediate by Oct 27, 2023.
Patch status
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.
Description
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Affected products
| Product | Vendor | Affected versions | Fixed in | Source |
|---|---|---|---|---|
| Cisco IOS XE Web UI | Cisco | — | — | KEV |
| Cisco networking & security | Cisco | 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1a | 17.3.8a; 17.6.6a; 17.9.4a; 16.12.10a | NVD |
Sources: KEV = CISA Known Exploited Vulnerabilities catalog; NVD = NIST National Vulnerability Database.
Intelligence timeline
Developments from the last 30 days, newest first.
- CVSS scoredUpdateKEV
CVE-2023-20273 scored CVSS 7.2: Cisco Cisco IOS XE Web UI, Cisco IOS XE Web UI Command Injection Vulnerability
CISA lists this as exploited in the wild. Unpatched Cisco IOS XE Web UI systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
1 earlier event is available with a subscription. See plans.
Coverage
We have not published a story about this vulnerability yet.