CVE-2023-20273A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root.
Updated under an hour ago ()
Does this affect you?
It affects Cisco IOS XE Software and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Oct 23, 2023; federal agencies had to remediate by Oct 27, 2023. Treat that date as your deadline.
Do this next
Free account, 1 product
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
- CVSS
- 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Added to CISA KEV Oct 23, 2023; federal remediation due Oct 27, 2023Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
- EPSS (exploitation in the next 30 days)
- 92.99% (percentile 100)
- Assigned by
- cisco
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Cisco Cisco IOS XE Software cisco:ios_xe_software (from the name) | 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; 16.3.2; 16.3.3; and 178 more ranges | CNA record |
cisco ios_xe cisco:ios_xe | 16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1a; 16.3.2; 16.3.3; and 181 more ranges | NVD |
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4zvendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20273us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.