Cisco IOS XE Web UI Command Injection Vulnerability

HIGH 7.2EXPLOITED (CISA KEV)CVE-2023-20273 · Published 25/10/2023 · updated 17/06/2026

Cisco IOS XE Web UI Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 23/10/2023. Patch affected systems as an emergency.

In short

CVE-2023-20273 is a HIGH (CVSS 7.2) vulnerability.
Exploited in the wild: CISA added it to the KEV catalog on 23/10/2023.
Chance of exploitation in the next 30 days (EPSS): 92.9%, higher than 99.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
Cisco IOS XE Web UI Cisco	Versions not published yet (product named by CISA KEV)

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2023-20273

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free