CVE-2026-20113

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to arbitrarily inject log entries, manipulate the structure of log files, or obscure legitimate log events.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-93

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
CiscoCisco IOS XE Software16.6.1; 16.6.2; 16.6.3; 16.6.4; 16.6.5; 16.6.4a; 16.6.5a; 16.6.6; 16.6.7; 16.6.8; 16.6.9; 16.6.10; 16.7.1; 16.7.1a; 16.7.1b; 16.7.2; 16.7.3; 16.7.4; 16.8.1; 16.8.1a

References

Timeline

Published
Mar 25, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-201145.4A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to eCVE-2026-201156.1A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device informaCVE-2026-201166.1A vulnerability in the web-based management interface of  Cisco Finesse, Cisco Packaged Contact Center Enterprise (Packaged CCE), CiscoCVE-2026-201176.1A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, CVE-2026-201186.8A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network CoCVE-2026-201197.5A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could aCVE-2026-20129.8A vulnerability was determined in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /ramonCVE-2026-201205.8A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security ApplianCVE-2026-201215.3A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security ApplianCVE-2026-201225.4A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on thCVE-2026-201236.1A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coCVE-2026-201247.7A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote att
CVE-2026-20113: Medium severity, CVSS 5.3 | Vulnix