Vulnerabilities > CVE-2023-20273 - Unspecified vulnerability in Cisco IOS XE

CVSS 7.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

cisco

NVD

Published: 2023-10-25

Updated: 2024-01-25

Summary

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS XE 17.3 Cisco IOS XE 17.3.1 Cisco IOS XE 17.3.1A Cisco IOS XE 17.3.1W Cisco IOS XE 17.3.1X Cisco IOS XE 17.3.1Z Cisco IOS XE 17.3.2 Cisco IOS XE 17.3.2A Cisco IOS XE 17.3.3 Cisco IOS XE 17.3.3A Cisco IOS XE 17.3.4 Cisco IOS XE 17.3.4A Cisco IOS XE 17.3.4B Cisco IOS XE 17.3.4C Cisco IOS XE 17.3.5 Cisco IOS XE 17.3.5A Cisco IOS XE 17.3.5B Cisco IOS XE 17.3.6 Cisco IOS XE 17.3.7 Cisco IOS XE 17.6 Cisco IOS XE 17.6.0 Cisco IOS XE 17.6.1 Cisco IOS XE 17.6.1.Z Cisco IOS XE 17.6.1A Cisco IOS XE 17.6.1W Cisco IOS XE 17.6.1X Cisco IOS XE 17.6.1Y Cisco IOS XE 17.6.1Z Cisco IOS XE 17.6.1Z1 Cisco IOS XE 17.6.2 Cisco IOS XE 17.6.3 Cisco IOS XE 17.6.3A Cisco IOS XE 17.6.4 Cisco IOS XE 17.6.5 Cisco IOS XE 17.9 Cisco IOS XE 17.9.1 Cisco IOS XE 17.9.1A Cisco IOS XE 17.9.1W Cisco IOS XE 17.9.1X Cisco IOS XE 17.9.1X1 Cisco IOS XE 17.9.1Y Cisco IOS XE 17.9.1Y1 Cisco IOS XE 17.9.2 Cisco IOS XE 17.9.2A Cisco IOS XE 17.9.2B Cisco IOS XE 17.9.3 Cisco IOS XE 17.9.3A Cisco IOS XE 16.12 Cisco IOS XE 16.12.0 Cisco IOS XE 16.12.1 Cisco IOS XE 16.12.1A Cisco IOS XE 16.12.1B Cisco IOS XE 16.12.1C Cisco IOS XE 16.12.1D Cisco IOS XE 16.12.1S Cisco IOS XE 16.12.1T Cisco IOS XE 16.12.1W Cisco IOS XE 16.12.1X Cisco IOS XE 16.12.1Y Cisco IOS XE 16.12.1Z Cisco IOS XE 16.12.1Z1 Cisco IOS XE 16.12.1Z2 Cisco IOS XE 16.12.1Za Cisco IOS XE 16.12.2 Cisco IOS XE 16.12.2A Cisco IOS XE 16.12.2R Cisco IOS XE 16.12.2S Cisco IOS XE 16.12.2T Cisco IOS XE 16.12.3 Cisco IOS XE 16.12.3A Cisco IOS XE 16.12.3S Cisco IOS XE 16.12.4 Cisco IOS XE 16.12.4A Cisco IOS XE 16.12.5 Cisco IOS XE 16.12.5A Cisco IOS XE 16.12.5B Cisco IOS XE 16.12.6 Cisco IOS XE 16.12.6A Cisco IOS XE 16.12.7 Cisco IOS XE 16.12.8 Cisco IOS XE 16.12.9	81
Hardware	Cisco Cisco Catalyst 3650 - Cisco Catalyst 3650 12X48Fd E - Cisco Catalyst 3650 12X48Fd L - Cisco Catalyst 3650 12X48Fd S - Cisco Catalyst 3650 12X48Uq - Cisco Catalyst 3650 12X48Uq E - Cisco Catalyst 3650 12X48Uq L - Cisco Catalyst 3650 12X48Uq S - Cisco Catalyst 3650 12X48Ur - Cisco Catalyst 3650 12X48Ur E - Cisco Catalyst 3650 12X48Ur L - Cisco Catalyst 3650 12X48Ur S - Cisco Catalyst 3650 12X48Uz - Cisco Catalyst 3650 12X48Uz E - Cisco Catalyst 3650 12X48Uz L - Cisco Catalyst 3650 12X48Uz S - Cisco Catalyst 3650 24Pd - Cisco Catalyst 3650 24Pd E - Cisco Catalyst 3650 24Pd L - Cisco Catalyst 3650 24Pd S - Cisco Catalyst 3650 24Pdm - Cisco Catalyst 3650 24Pdm E - Cisco Catalyst 3650 24Pdm L - Cisco Catalyst 3650 24Pdm S - Cisco Catalyst 3650 24Ps E - Cisco Catalyst 3650 24Ps L - Cisco Catalyst 3650 24Ps S - Cisco Catalyst 3650 24Td E - Cisco Catalyst 3650 24Td L - Cisco Catalyst 3650 24Td S - Cisco Catalyst 3650 24Ts E - Cisco Catalyst 3650 24Ts L - Cisco Catalyst 3650 24Ts S - Cisco Catalyst 3650 48Fd E - Cisco Catalyst 3650 48Fd L - Cisco Catalyst 3650 48Fd S - Cisco Catalyst 3650 48Fq - Cisco Catalyst 3650 48Fq E - Cisco Catalyst 3650 48Fq L - Cisco Catalyst 3650 48Fq S - Cisco Catalyst 3650 48Fqm - Cisco Catalyst 3650 48Fqm E - Cisco Catalyst 3650 48Fqm L - Cisco Catalyst 3650 48Fqm S - Cisco Catalyst 3650 48Fs E - Cisco Catalyst 3650 48Fs L - Cisco Catalyst 3650 48Fs S - Cisco Catalyst 3650 48Pd E - Cisco Catalyst 3650 48Pd L - Cisco Catalyst 3650 48Pd S - Cisco Catalyst 3650 48Pq E - Cisco Catalyst 3650 48Pq L - Cisco Catalyst 3650 48Pq S - Cisco Catalyst 3650 48Ps E - Cisco Catalyst 3650 48Ps L - Cisco Catalyst 3650 48Ps S - Cisco Catalyst 3650 48Td E - Cisco Catalyst 3650 48Td L - Cisco Catalyst 3650 48Td S - Cisco Catalyst 3650 48Tq E - Cisco Catalyst 3650 48Tq L - Cisco Catalyst 3650 48Tq S - Cisco Catalyst 3650 48Ts E - Cisco Catalyst 3650 48Ts L - Cisco Catalyst 3650 48Ts S - Cisco Catalyst 3650 8X24Pd E - Cisco Catalyst 3650 8X24Pd L - Cisco Catalyst 3650 8X24Pd S - Cisco Catalyst 3650 8X24Uq - Cisco Catalyst 3650 8X24Uq E - Cisco Catalyst 3650 8X24Uq L - Cisco Catalyst 3650 8X24Uq S - Cisco Catalyst 3850 - Cisco Catalyst 3850 12S E - Cisco Catalyst 3850 12S S - Cisco Catalyst 3850 12X48U - Cisco Catalyst 3850 12Xs E - Cisco Catalyst 3850 12Xs S - Cisco Catalyst 3850 16Xs E - Cisco Catalyst 3850 16Xs S - Cisco Catalyst 3850 24P E - Cisco Catalyst 3850 24P L - Cisco Catalyst 3850 24P S - Cisco Catalyst 3850 24Pw S - Cisco Catalyst 3850 24S E - Cisco Catalyst 3850 24S S - Cisco Catalyst 3850 24T E - Cisco Catalyst 3850 24T L - Cisco Catalyst 3850 24T S - Cisco Catalyst 3850 24U - Cisco Catalyst 3850 24U E - Cisco Catalyst 3850 24U L - Cisco Catalyst 3850 24U S - Cisco Catalyst 3850 24Xs - Cisco Catalyst 3850 24Xs E - Cisco Catalyst 3850 24Xs S - Cisco Catalyst 3850 24Xu - Cisco Catalyst 3850 24Xu E - Cisco Catalyst 3850 24Xu L - Cisco Catalyst 3850 24Xu S - Cisco Catalyst 3850 32Xs E - Cisco Catalyst 3850 32Xs S - Cisco Catalyst 3850 48F E - Cisco Catalyst 3850 48F L - Cisco Catalyst 3850 48F S - Cisco Catalyst 3850 48P E - Cisco Catalyst 3850 48P L - Cisco Catalyst 3850 48P S - Cisco Catalyst 3850 48Pw S - Cisco Catalyst 3850 48T E - Cisco Catalyst 3850 48T L - Cisco Catalyst 3850 48T S - Cisco Catalyst 3850 48U - Cisco Catalyst 3850 48U E - Cisco Catalyst 3850 48U L - Cisco Catalyst 3850 48U S - Cisco Catalyst 3850 48Xs - Cisco Catalyst 3850 48Xs E - Cisco Catalyst 3850 48Xs F E - Cisco Catalyst 3850 48Xs F S - Cisco Catalyst 3850 48Xs S - Cisco Catalyst 3850 NM 2 40G - Cisco Catalyst 3850 NM 8 10G -	123

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z