All vulnerabilities
CVE-2023-20273

Cisco IOS XE Web UI Command Injection Vulnerability

Cisco Cisco IOS XE Web UINetwork & edge
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationExploited in the wildAdded to KEV 23 Oct 2023CISA KEV
Exploit odds (EPSS)93.0%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline27 Oct 2023Remediation due date for US federal agenciesCISA KEV
CISA required actionVerify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 16 Oct 2023Exploit code publicMetasploit
  2. 23 Oct 2023Added to CISA KEVCISA KEV
  3. 24 Oct 2023, 14:13 UTCPublishedCVE List

Public exploit code and templates 2

  • Exploit moduleCisco IOX XE Unauthenticated RCE Chain 16 Oct 2023Metasploit
  • Auxiliary moduleCisco IOX XE unauthenticated OS command execution 16 Oct 2023Metasploit

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.

Text from CVE List

Affected versions 30

  • Cisco IOS XE Softwareaffected: 16.1.1CVE List
  • Cisco IOS XE Softwareaffected: 16.1.2CVE List
  • Cisco IOS XE Softwareaffected: 16.1.3CVE List
  • Cisco IOS XE Softwareaffected: 16.2.1CVE List
  • Cisco IOS XE Softwareaffected: 16.2.2CVE List
  • Cisco IOS XE Softwareaffected: 16.3.1CVE List
  • Cisco IOS XE Softwareaffected: 16.3.2CVE List
  • Cisco IOS XE Softwareaffected: 16.3.3CVE List
  • Cisco IOS XE Softwareaffected: 16.3.1aCVE List
  • Cisco IOS XE Softwareaffected: 16.3.4CVE List
  • Cisco IOS XE Softwareaffected: 16.3.5CVE List
  • Cisco IOS XE Softwareaffected: 16.3.5bCVE List
  • Cisco IOS XE Softwareaffected: 16.3.6CVE List
  • Cisco IOS XE Softwareaffected: 16.3.7CVE List
  • Cisco IOS XE Softwareaffected: 16.3.8CVE List
  • Cisco IOS XE Softwareaffected: 16.3.9CVE List
  • Cisco IOS XE Softwareaffected: 16.3.10CVE List
  • Cisco IOS XE Softwareaffected: 16.3.11CVE List
  • Cisco IOS XE Softwareaffected: 16.4.1CVE List
  • Cisco IOS XE Softwareaffected: 16.4.2CVE List
  • Cisco IOS XE Softwareaffected: 16.4.3CVE List
  • Cisco IOS XE Softwareaffected: 16.5.1CVE List
  • Cisco IOS XE Softwareaffected: 16.5.1aCVE List
  • Cisco IOS XE Softwareaffected: 16.5.1bCVE List
  • Cisco IOS XE Softwareaffected: 16.5.2CVE List
  • Cisco IOS XE Softwareaffected: 16.5.3CVE List
  • Cisco IOS XE Softwareaffected: 16.6.1CVE List
  • Cisco IOS XE Softwareaffected: 16.6.2CVE List
  • Cisco IOS XE Softwareaffected: 16.6.3CVE List
  • Cisco IOS XE Softwareaffected: 16.6.4CVE List

References 3