CVE-2023-20235

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-04 · updated 2026-06-17
Weakness: CWE-552

Description

A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user. This vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems.

Affected products

Cisco IOS XE: before 17.3.1 — fixed in 17.3.1

How to fix

Upgrade to a fixed version: Cisco IOS XE 17.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-20235 or the next vulnerability affects your stack