{"id":"CVE-2023-20273","published":"2023-10-25T18:17:23Z","modified":"2026-06-17T05:30:12Z","title":"Cisco IOS XE Web UI Command Injection Vulnerability","vendor":"Cisco","product":"Cisco IOS XE Web UI","tier":"core","eol":null,"description":{"text":"A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw in the web UI feature of Cisco IOS XE Software results from insufficient input validation. An attacker who is authenticated and has remote network access can send crafted input to the web UI to run operating system commands with root privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:43:52Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.92938,"percentile":0.99831,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-10-23","dueDate":"2023-10-27","ransomware":false,"requiredAction":"Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z;  https://nvd.nist.gov/vuln/detail/CVE-2023-20273","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-10-16","exploitedFirstSeen":"2023-10-16","ransomware":false,"evidence":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-10-23"},{"url":"https://blog.talosintelligence.com/content/files/2023/12/2023_Talos_Year_In_Review.pdf","date":"2023-12-07"},{"url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2024-CTI-002.pdf","date":"2024-02-27"},{"url":"https://www.ptsecurity.com/ww-en/analytics/cybersecurity-threatscape-2023-q4/","date":"2024-03-05"},{"url":"https://www.rapid7.com/globalassets/_pdfs/research/rapid7_2024_attack_intelligence_report.pdf","date":"2024-05-21"},{"url":"https://labs.withsecure.com/publications/mass-exploitation-the-vulnerable-edge-of-enterprise-security","date":"2024-06-12"},{"url":"https://www.cisa.gov/sites/default/files/2024-11/aa24-317a-2023-top-routinely-exploited-vulnerabilities.pdf","date":"2024-11-12"},{"url":"https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/2023-top-routinely-exploited-vulnerabilities","date":"2024-11-13"}],"evidenceTotal":38,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","tags":["Vendor Advisory"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20273","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write an implant to the file system, further compromising the device.\n\nThis CVE was exploited after the adversary exploited CVE-2023-20198.","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","report-attack-id"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection; ATT&CK ID T1068 written in the same sentence as CVE-2023-20273","mappingType":"primary_impact","evidence":[{"reportId":"SRC-8d5517bedbda024608fa","quote":"CVE-2023-20273 - Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation (commonly chained with CVE-2023-20198 for initial access to achieve code execution as root) [T1068]","start":8581,"end":8843}],"comment":"This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write malicious implants that enable them to execute arbitrary commands to the file system\n\nThis CVE was exploited after the adversary exploited CVE-2023-20198.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write malicious implants that enable them to execute arbitrary commands to the file system\n\nThis CVE was exploited after the adversary exploited CVE-2023-20198.","confidence":"high"}],"reports":[{"id":"SRC-d6831d4223ab36771b1a","title":"Weathering the storm: In the midst of a Typhoon","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","date":"2025-02-20","mentions":[{"quote":"CVE-2023-20198, CVE-2023-20273 - Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature (Last Updated: 1-Nov-2023)","start":2347,"end":2471}]},{"id":"SRC-8d5517bedbda024608fa","title":"Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a","date":null,"mentions":[{"quote":"CVE-2023-20273 - Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation (commonly chained with CVE-2023-20198 for initial access to achieve code execution as root) [T1068]","start":8581,"end":8843},{"quote":"Exploit CVE-2023-20273 to gain root-level user privileges","start":80522,"end":80579},{"quote":"CVE-2023-20273","start":84648,"end":84662}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-24452","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24452","exploited":true,"exploitedSince":"2023-10-23","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-12-09","earliestUrl":"https://github.com/smokeintheshell/CVE-2023-20273","repos":[{"name":"smokeintheshell/CVE-2023-20273","url":"https://github.com/smokeintheshell/CVE-2023-20273","stars":15,"created":"2023-12-09"}]},"metasploit":[{"name":"Cisco IOX XE unauthenticated OS command execution","module":"auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273","type":"auxiliary","disclosureDate":"2023-10-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb"},{"name":"Cisco IOX XE Unauthenticated RCE Chain","module":"exploit/linux/misc/cisco_ios_xe_rce","type":"exploit","disclosureDate":"2023-10-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/cisco_ios_xe_rce.rb"}],"first":{"date":"2023-10-16","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"source"},{"stage":"primary","techniques":["T1068"],"provenance":"source"},{"stage":"secondary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2023-10-16","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-12-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb","provenance":"source"},{"date":"2023-10-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","provenance":"source"},{"date":"2023-10-23","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-10-23","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24452","provenance":"source"},{"date":"2023-10-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20273","provenance":"source"},{"date":"2025-02-20","kind":"report","label":"Named in blog.talosintelligence.com: Weathering the storm: In the midst of a Typhoon","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":74.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1109 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 2 Metasploit modules"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-cisco-ios-xe-cwe-78"}}