Actively exploited · Published Oct 24, 2023 · Assigned by cisco
CVE-2023-20273
High 7.2 Exploited
In plain English
A high-severity OS command injection in Cisco IOS XE Software from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on October 23, 2023). The chance it is exploited in the next 30 days is estimated at 92.9% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
CISA guidance
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Federal agencies must remediate by Oct 27, 2023.
Official description
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco IOS XE Software | 16.1.116.1.216.1.316.2.116.2.216.3.116.3.216.3.3 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H