CVE-2023-20209

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code execution on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to establish a remote shell with root privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-77

Affected software

Vendor	Product	Versions
Cisco	Cisco TelePresence Video Communication Server (VCS) Expressway	X8.5.1; X8.5.3; X8.5; X8.6.1; X8.6; X8.1.1; X8.1.2; X8.1; X8.2.1; X8.2.2; X8.2; X8.7.1; X8.7.2; X8.7.3; X8.7; X8.8.1; X8.8.2; X8.8.3; X8.8; X8.9.1

References

Timeline

Published: Aug 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-20215.4Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.CVE-2023-202106.0A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected devic CVE-2023-202118.8A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications CVE-2023-202127.5A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition CVE-2023-202134.3A vulnerability in the CDP processing feature of Cisco ISE could allow an unauthenticated, adjacent attacker to cause a denial of service (D CVE-2023-202149.1A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, r CVE-2023-202155.3A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote atta CVE-2023-202167.8A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker CVE-2023-202175.5A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local CVE-2023-202186.1A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remo CVE-2023-202198.8Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, r CVE-2023-20224.3An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, a