CVE-2020-3223: Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-03 · updated 2026-06-17
Weakness: CWE-59

Description

A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web UI. An exploit could allow the attacker to read arbitrary files from the underlying operating system's filesystem.

Affected products

Cisco IOS XE: 16.9.4, 16.9.4c, 16.11.1, 16.11.1a, 16.11.1b, 16.11.1c (+9)

References

Get alerted when CVE-2020-3223 or the next vulnerability affects your stack