CVE · Exploited · On CISA KEV

CVE-2023-20273

Cisco IOS XE Web UI Command Injection Vulnerability

7.2: CVSS 3.1
1: story
OCT 23: added to KEV

Severity: 7.2 High · NVD score
Vendor: Cisco
Product: Cisco IOS XE Web UI
Published: Oct 25, 2023
Added to KEV: Oct 23, 2023
KEV deadline: Oct 27, 2023
Ransomware use: Unknown
Weakness: CWE-78

What it is

Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

AUG 27
IntrusionsUS Gov Links Private Chinese Firms to Salt Typhoon HacksSalt Typhoon has not been observed exploiting zero-day flaws, but instead targeting known bugs in exposed network edge devices – some of which are years old.LINDSEY O'DONNELL-WELCH · 3 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z