CVE-2023-20250

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary code with root privileges on an affected device. To exploit this vulnerability, the attacker must have valid Administrator credentials on the affected device.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-202515.3A vulnerability in the memory buffer of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attackeCVE-2023-202529.8A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticatCVE-2023-202535.5A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attackeCVE-2023-202548.8A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remCVE-2023-202555.3A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a deniaCVE-2023-202565.8Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefCVE-2023-202574.8A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conductCVE-2023-202587.2A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to executeCVE-2023-202597.5A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to causCVE-2023-20264.8The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to CVE-2023-202606.7A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticCVE-2023-202616.5A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files fro
CVE-2023-20250: High severity, CVSS 7.2 | Vulnix