Skip to content

CVE · Exploited · On CISA KEV

CVE-2023-20198

Cisco IOS XE Web UI Privilege Escalation Vulnerability

10.0
CVSS 3.1
1
story
OCT 16
added to KEV
Severity
10.0 Critical · NVD score
Vendor
Cisco
Product
IOS XE Web UI
Published
Oct 16, 2023
Added to KEV
Oct 16, 2023
KEV deadline
Oct 20, 2023
Ransomware use
Unknown
Weakness
CWE-420
Part of Salt Typhoon Telecom Hacks →

What it is

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. IntrusionsUS Gov Links Private Chinese Firms to Salt Typhoon HacksSalt Typhoon has not been observed exploiting zero-day flaws, but instead targeting known bugs in exposed network edge devices – some of which are years old.LINDSEY O'DONNELL-WELCH · 3 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixsec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4zFixsec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z