CVE-2023-20273: Cisco IOS XE Web UI Command Injection Vulnerability

CVSS: 7.2v3.1HighKEVAnalyzed

Published 24-10-2023Last modified 21-10-2025

Vulnerability summary

CVE-2023-20273 is a high (CVSS 7.2) OS Command Injection vulnerability in Cisco Cisco IOS XE Web UI. It is known to be exploited: CISA lists it, first on 23-10-2023. EPSS estimates a 92.99% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

7.2/10

010

High · v3.1 (CVE.org)

EPSS score

92.99%

0%100%

Critical · +3.36 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits2metasploit

Timeline

23-10-2023
Added to CISA KEVCisco IOS XE Web UI Command Injection Vulnerability
24-10-2023
PublishedVulnerability first disclosed.
27-10-2023
CISA remediation dueApply mitigations per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

CVSS metrics

2 scores · 2 sources · 1 version

v3.17.2

EPSS trend

Probability

92.99%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+3.36 pp

From 89.63% on 17-09-2026

17-09-202617-10-2026

EPSS score

92.99%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 23-10-2023
Federal due date: 27-10-2023

CISA required action

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA. sec.cloudapps.cisco.com/security/… nvd.nist.gov/vuln/detail/CVE-2023-20273

Public exploits

2 found

MetasploitremoteUnverified
Cisco IOX XE unauthenticated OS command execution
auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273
Maturity: poc
MetasploitremoteVerified
Cisco IOX XE Unauthenticated RCE Chain
exploit/linux/misc/cisco_ios_xe_rce
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Cisco2 products

cisco ios xe software16.1.1 | 16.1.2 | 16.1.3 | 16.2.1 | 16.2.2 | 16.3.1 | 16.3.2 | 16.3.3 | 16.3.1a | 16.3.4 | 16.3.5 | 16.3.5b | 16.3.6 | 16.3.7 | 16.3.8 | 16.3.9 | 16.3.10 | 16.3.11 | 16.4.1 | 16.4.2 | 16.4.3 | 16.5.1 | 16.5.1a | 16.5.1b | 16.5.2 | 16.5.3 | 16.6.1 | 16.6.2 | 16.6.3 | 16.6.4 | 16.6.5 | 16.6.4a | 16.6.5a | 16.6.6 | 16.6.7 | 16.6.8 | 16.6.9 | 16.6.10 | 16.7.1 | 16.7.1a | 16.7.1b | 16.7.2 | 16.7.3 | 16.7.4 | 16.8.1 | 16.8.1a | 16.8.1b | 16.8.1s | 16.8.1c | 16.8.1d | 16.8.2 | 16.8.1e | 16.8.3 | 16.9.1 | 16.9.2 | 16.9.1a | 16.9.1b | 16.9.1s | 16.9.3 | 16.9.4 | 16.9.3a | 16.9.5 | 16.9.5f | 16.9.6 | 16.9.7 | 16.9.8 | 16.10.1 | 16.10.1a | 16.10.1b | 16.10.1s | 16.10.1c | 16.10.1e | 16.10.1d | 16.10.2 | 16.10.1f | 16.10.1g | 16.10.3 | 16.11.1 | 16.11.1a | 16.11.1b | 16.11.2 | 16.11.1s | 16.12.1 | 16.12.1s | 16.12.1a | 16.12.1c | 16.12.1w | 16.12.2 | 16.12.1y | 16.12.2a | 16.12.3 | 16.12.8 | 16.12.2s | 16.12.1x | 16.12.1t | 16.12.4 | 16.12.3s | 16.12.3a | 16.12.4a | 16.12.5 | 16.12.6 | 16.12.1z1 | 16.12.5a | 16.12.5b | 16.12.1z2 | 16.12.6a | 16.12.7 | 16.12.9 | 16.12.10 | 17.1.1 | 17.1.1a | 17.1.1s | 17.1.1t | 17.1.3 | 17.2.1 | 17.2.1r | 17.2.1a | 17.2.1v | 17.2.2 | 17.2.3 | 17.3.1 | 17.3.2 | 17.3.3 | 17.3.1a | 17.3.1w | 17.3.2a | 17.3.1x | 17.3.1z | 17.3.4 | 17.3.5 | 17.3.4a | 17.3.6 | 17.3.4b | 17.3.4c | 17.3.5a | 17.3.5b | 17.3.7 | 17.3.8 | 17.4.1 | 17.4.2 | 17.4.1a | 17.4.1b | 17.4.2a | 17.5.1 | 17.5.1a | 17.5.1b | 17.5.1c | 17.6.1 | 17.6.2 | 17.6.1w | 17.6.1a | 17.6.1x | 17.6.3 | 17.6.1y | 17.6.1z | 17.6.3a | 17.6.4 | 17.6.1z1 | 17.6.5 | 17.6.6 | 17.7.1 | 17.7.1a | 17.7.1b | 17.7.2 | 17.10.1 | 17.10.1a | 17.10.1b | 17.8.1 | 17.8.1a | 17.9.1 | 17.9.1w | 17.9.2 | 17.9.1a | 17.9.1x | 17.9.1y | 17.9.3 | 17.9.2a | 17.9.1x1 | 17.9.3a | 17.9.4 | 17.9.1y1 | 17.11.1 | 17.11.1a | 17.12.1 | 17.12.1a | 17.11.99SW
ios_xe16.1.1 | 16.1.2 | 16.1.3 | 16.2.1 | 16.2.2 | 16.3.1a | 16.3.2 | 16.3.3 | 16.3.4 | 16.3.5 | 16.3.5b | 16.3.6 | 16.3.7 | 16.3.8 | 16.3.9 | 16.3.10 | 16.3.11 | 16.4.1 | 16.4.2 | 16.4.3 | 16.5.1 | 16.5.1a | 16.5.1b | 16.5.2 | 16.5.3 | 16.6.1 | 16.6.2 | 16.6.3 | 16.6.4 | 16.6.4a | 16.6.5 | 16.6.5a | 16.6.6 | 16.6.7 | 16.6.8 | 16.6.9 | 16.6.10 | 16.7.1 | 16.7.1a | 16.7.1b | 16.7.2 | 16.7.3 | 16.7.4 | 16.8.1 | 16.8.1a | 16.8.1b | 16.8.1c | 16.8.1d | 16.8.1e | 16.8.1s | 16.8.2 | 16.8.3 | 16.9.1 | 16.9.1a | 16.9.1b | 16.9.1s | 16.9.2 | 16.9.3 | 16.9.3a | 16.9.4 | 16.9.5 | 16.9.5f | 16.9.6 | 16.9.7 | 16.9.8 | 16.10.1 | 16.10.1a | 16.10.1b | 16.10.1c | 16.10.1d | 16.10.1e | 16.10.1f | 16.10.1g | 16.10.1s | 16.10.2 | 16.10.3 | 16.11.1 | 16.11.1a | 16.11.1b | 16.11.1s | 16.11.2 | 16.12.1 | 16.12.1a | 16.12.1c | 16.12.1s | 16.12.1t | 16.12.1w | 16.12.1x | 16.12.1y | 16.12.1z1 | 16.12.1z2 | 16.12.2 | 16.12.2a | 16.12.2s | 16.12.3 | 16.12.3a | 16.12.3s | 16.12.4 | 16.12.4a | 16.12.5 | 16.12.5a | 16.12.5b | 16.12.6 | 16.12.6a | 16.12.7 | 16.12.8 | 16.12.9 | 16.12.10 | 17.1.1 | 17.1.1a | 17.1.1s | 17.1.1t | 17.1.3 | 17.2.1 | 17.2.1a | 17.2.1r | 17.2.1v | 17.2.2 | 17.2.3 | 17.3.1 | 17.3.1a | 17.3.1w | 17.3.1x | 17.3.1z | 17.3.2 | 17.3.2a | 17.3.3 | 17.3.4 | 17.3.4a | 17.3.4b | 17.3.4c | 17.3.5 | 17.3.5a | 17.3.5b | 17.3.6 | 17.3.7 | 17.3.8 | 17.4.1 | 17.4.1a | 17.4.1b | 17.4.2 | 17.4.2a | 17.5.1 | 17.5.1a | 17.5.1b | 17.5.1c | 17.6.1 | 17.6.1a | 17.6.1w | 17.6.1x | 17.6.1y | 17.6.1z | 17.6.1z1 | 17.6.2 | 17.6.3 | 17.6.3a | 17.6.4 | 17.6.5 | 17.6.6 | 17.7.1 | 17.7.1a | 17.7.1b | 17.7.2 | 17.8.1 | 17.8.1a | 17.9.1 | 17.9.1a | 17.9.1w | 17.9.1x | 17.9.1x1 | 17.9.1y | 17.9.1y1 | 17.9.2 | 17.9.2a | 17.9.3 | 17.9.3a | 17.9.4 | 17.10.1 | 17.10.1a | 17.10.1b | 17.11.1 | 17.11.1a | 17.11.99sw | 17.12.1 | 17.12.1a | ≥ 17.3, < 17.3.8a | ≥ 17.6, < 17.6.6a | ≥ 17.9, < 17.9.4a | ≥ 16.12, < 16.12.10a

1 vendor · 2 products

References

2 links

sec.cloudapps.cisco.com/security/…Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20273Government ResourceUS Government Resource