CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Cisco IOS XE Web UI Remote Command Injection and Root Privilege Escalation Vulnerability (CVE-2023-20273) Analysis and Mitigation Guide
[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled on network devices
[Impact] An authenticated, remote attacker can exploit insufficient input validation to inject arbitrary commands into the underlying operating system with root privileges, leading to complete system compromise
[Mitigation] Immediately disable the Web UI feature or upgrade to the latest patched Cisco IOS XE software release
Cisco IOS XE Web UI Remote Privilege Escalation and System Compromise (CVE-2023-20198)
[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled and exposed to the internet
[Impact] Unauthenticated remote attackers can bypass authentication to create a local user with Privilege 15 access, subsequently elevating to root to install a persistent malicious implant
[Mitigation] Immediately disable the Web UI (HTTP/HTTPS Server) feature or restrict access to trusted management networks, and upgrade to the recommended fixed software releases