A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the pri
Affects Cisco IOS XE Software with the web UI feature enabled through the ip http server or ip http secure-server commands. The checked facts list no affected versions and no fix.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The web UI feature of Cisco IOS XE Software is affected. An authenticated remote attacker could exploit this flaw by sending crafted input, allowing them to run commands on the underlying operating system with root privileges.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Timeline
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CVE published
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Cisco Cisco IOS XE Software
16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4, 16.3.5, 16.3.5b, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.3.10, 16.3.11, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.2, 16.6.3, 16.6.4, and 156 more
References 1
sec.cloudapps.cisco.com
Questions about CVE-2023-20273
What does this mean?
An authenticated remote attacker can inject commands through the web UI and escalate privilege to root. From there they can run commands on the underlying operating system, including writing an implant to the file system.Source: sec.cloudapps.cisco.com
Am I affected, and how do I check?
The issue applies only when the web UI feature is enabled through the ip http server or ip http secure-server commands. The checked facts do not list affected versions, so check the running configuration for those commands and confirm the version with the vendor advisory.Source: sec.cloudapps.cisco.com
What should I do about it?
The checked facts name no fixed release, so no upgrade target can be given. Check the Cisco advisory for a fixed version and apply it when available.Source: sec.cloudapps.cisco.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-10-23, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
Limit exposure by turning off the feature the bug depends on: disable the web UI with no ip http server and no ip http secure-server if it is not needed. Keep the web UI off until a fix is published.Source: sec.cloudapps.cisco.com