CVE-2023-20273

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
CiscoCisco IOS XE Software16.1.1; 16.1.2; 16.1.3; 16.2.1; 16.2.2; 16.3.1; 16.3.2; 16.3.3; 16.3.1a; 16.3.4; 16.3.5; 16.3.5b; 16.3.6; 16.3.7; 16.3.8; 16.3.9; 16.3.10; 16.3.11; 16.4.1; 16.4.2

References

Timeline

Published
Oct 25, 2023
Last modified
Jun 17, 2026
Added to CISA KEV
Oct 23, 2023
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-202747.8A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to elevate privileges onCVE-2023-202754.3A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTCVE-2023-20284.8The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilCVE-2023-20294.8The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perfCVE-2023-20305.3An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.CVE-2023-20315.4The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up CVE-2023-20329.8The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilitiCVE-2023-20338.8Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a craftedCVE-2023-20348.8Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.CVE-2023-20357.5A vulnerability has been found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this vulnerability is an unknoCVE-2023-20367.5A vulnerability was found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this issue is some unknown functionCVE-2023-20379.8A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been classified as critical. This affects an unknown part of the fi