What’s Vulnerable › Vulnerabilities

CVE-2023-20273: Cisco IOS XE Web UI Command Injection Vulnerability

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-10-23
• EPSS: 92.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-25 · updated 2026-06-17
• Weakness: CWE-78

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Affected products

• Cisco IOS XE: from 17.3 before 17.3.8a; from 17.6 before 17.6.6a; from 17.9 before 17.9.4a; from 16.12 before 16.12.10a; 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1a (+179) — fixed in 16.12.10a, 17.3.8a, 17.6.6a, 17.9.4a

How to fix

Upgrade to a fixed version: Cisco IOS XE 16.12.10a, 17.3.8a, 17.6.6a, 17.9.4a. Check the vendor advisory for mitigations.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20273

Get alerted when CVE-2023-20273 or the next vulnerability affects your stack