CVE-2023-20273

State: Published
Severity: 7.2 High
Published: Oct 24, 2023
Updated: Oct 21, 2025
Reserved: Oct 27, 2022

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Cisco IOS XE SoftwareCisco	16.1.1Affected 16.1.2Affected 16.1.3Affected 16.2.1Affected 16.2.2Affected 16.3.1Affected 16.3.2Affected 16.3.3Affected 16.3.1aAffected 16.3.4Affected 16.3.5Affected 16.3.5bAffected 16.3.6Affected 16.3.7Affected 16.3.8Affected 16.3.9Affected 16.3.10Affected 16.3.11Affected 16.4.1Affected 16.4.2Affected 16.4.3Affected 16.5.1Affected 16.5.1aAffected 16.5.1bAffected 16.5.2Affected and 161 more versions

Product

Versions

Cisco IOS XE SoftwareCisco

16.1.1Affected
16.1.2Affected
16.1.3Affected
16.2.1Affected
16.2.2Affected
16.3.1Affected
16.3.2Affected
16.3.3Affected
16.3.1aAffected
16.3.4Affected
16.3.5Affected
16.3.5bAffected
16.3.6Affected
16.3.7Affected
16.3.8Affected
16.3.9Affected
16.3.10Affected
16.3.11Affected
16.4.1Affected
16.4.2Affected
16.4.3Affected
16.5.1Affected
16.5.1aAffected
16.5.1bAffected
16.5.2Affected
and 161 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.