Lucene search

[email protected]NVD:CVE-2023-20273

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-20273

2023-10-2518:17:23

CWE-78

[email protected]

web.nvd.nist.gov

cisco

ios xe software

web ui

vulnerability

remote attacker

command injection

input validation

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.036 Low

EPSS

Percentile

91.8%

JSON

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Affected configurations

NVD

Node

ciscoios_xeRange17.3–17.3.8a

ciscoios_xeRange17.6–17.6.6a

ciscoios_xeRange17.9–17.9.4a

Node

ciscoios_xeRange16.12–16.12.10a

AND

ciscocatalyst_3650Match-

ciscocatalyst_3650-12x48fd-eMatch-

ciscocatalyst_3650-12x48fd-lMatch-

ciscocatalyst_3650-12x48fd-sMatch-

ciscocatalyst_3650-12x48uqMatch-

ciscocatalyst_3650-12x48uq-eMatch-

ciscocatalyst_3650-12x48uq-lMatch-

ciscocatalyst_3650-12x48uq-sMatch-

ciscocatalyst_3650-12x48urMatch-

ciscocatalyst_3650-12x48ur-eMatch-

ciscocatalyst_3650-12x48ur-lMatch-

ciscocatalyst_3650-12x48ur-sMatch-

ciscocatalyst_3650-12x48uzMatch-

ciscocatalyst_3650-12x48uz-eMatch-

ciscocatalyst_3650-12x48uz-lMatch-

ciscocatalyst_3650-12x48uz-sMatch-

ciscocatalyst_3650-24pdMatch-

ciscocatalyst_3650-24pd-eMatch-

ciscocatalyst_3650-24pd-lMatch-

ciscocatalyst_3650-24pd-sMatch-

ciscocatalyst_3650-24pdmMatch-

ciscocatalyst_3650-24pdm-eMatch-

ciscocatalyst_3650-24pdm-lMatch-

ciscocatalyst_3650-24pdm-sMatch-

ciscocatalyst_3650-24ps-eMatch-

ciscocatalyst_3650-24ps-lMatch-

ciscocatalyst_3650-24ps-sMatch-

ciscocatalyst_3650-24td-eMatch-

ciscocatalyst_3650-24td-lMatch-

ciscocatalyst_3650-24td-sMatch-

ciscocatalyst_3650-24ts-eMatch-

ciscocatalyst_3650-24ts-lMatch-

ciscocatalyst_3650-24ts-sMatch-

ciscocatalyst_3650-48fd-eMatch-

ciscocatalyst_3650-48fd-lMatch-

ciscocatalyst_3650-48fd-sMatch-

ciscocatalyst_3650-48fqMatch-

ciscocatalyst_3650-48fq-eMatch-

ciscocatalyst_3650-48fq-lMatch-

ciscocatalyst_3650-48fq-sMatch-

ciscocatalyst_3650-48fqmMatch-

ciscocatalyst_3650-48fqm-eMatch-

ciscocatalyst_3650-48fqm-lMatch-

ciscocatalyst_3650-48fqm-sMatch-

ciscocatalyst_3650-48fs-eMatch-

ciscocatalyst_3650-48fs-lMatch-

ciscocatalyst_3650-48fs-sMatch-

ciscocatalyst_3650-48pd-eMatch-

ciscocatalyst_3650-48pd-lMatch-

ciscocatalyst_3650-48pd-sMatch-

ciscocatalyst_3650-48pq-eMatch-

ciscocatalyst_3650-48pq-lMatch-

ciscocatalyst_3650-48pq-sMatch-

ciscocatalyst_3650-48ps-eMatch-

ciscocatalyst_3650-48ps-lMatch-

ciscocatalyst_3650-48ps-sMatch-

ciscocatalyst_3650-48td-eMatch-

ciscocatalyst_3650-48td-lMatch-

ciscocatalyst_3650-48td-sMatch-

ciscocatalyst_3650-48tq-eMatch-

ciscocatalyst_3650-48tq-lMatch-

ciscocatalyst_3650-48tq-sMatch-

ciscocatalyst_3650-48ts-eMatch-

ciscocatalyst_3650-48ts-lMatch-

ciscocatalyst_3650-48ts-sMatch-

ciscocatalyst_3650-8x24pd-eMatch-

ciscocatalyst_3650-8x24pd-lMatch-

ciscocatalyst_3650-8x24pd-sMatch-

ciscocatalyst_3650-8x24uqMatch-

ciscocatalyst_3650-8x24uq-eMatch-

ciscocatalyst_3650-8x24uq-lMatch-

ciscocatalyst_3650-8x24uq-sMatch-

ciscocatalyst_3850Match-

ciscocatalyst_3850-12s-eMatch-

ciscocatalyst_3850-12s-sMatch-

ciscocatalyst_3850-12x48uMatch-

ciscocatalyst_3850-12xs-eMatch-

ciscocatalyst_3850-12xs-sMatch-

ciscocatalyst_3850-16xs-eMatch-

ciscocatalyst_3850-16xs-sMatch-

ciscocatalyst_3850-24p-eMatch-

ciscocatalyst_3850-24p-lMatch-

ciscocatalyst_3850-24p-sMatch-

ciscocatalyst_3850-24pw-sMatch-

ciscocatalyst_3850-24s-eMatch-

ciscocatalyst_3850-24s-sMatch-

ciscocatalyst_3850-24t-eMatch-

ciscocatalyst_3850-24t-lMatch-

ciscocatalyst_3850-24t-sMatch-

ciscocatalyst_3850-24uMatch-

ciscocatalyst_3850-24u-eMatch-

ciscocatalyst_3850-24u-lMatch-

ciscocatalyst_3850-24u-sMatch-

ciscocatalyst_3850-24xsMatch-

ciscocatalyst_3850-24xs-eMatch-

ciscocatalyst_3850-24xs-sMatch-

ciscocatalyst_3850-24xuMatch-

ciscocatalyst_3850-24xu-eMatch-

ciscocatalyst_3850-24xu-lMatch-

ciscocatalyst_3850-24xu-sMatch-

ciscocatalyst_3850-32xs-eMatch-

ciscocatalyst_3850-32xs-sMatch-

ciscocatalyst_3850-48f-eMatch-

ciscocatalyst_3850-48f-lMatch-

ciscocatalyst_3850-48f-sMatch-

ciscocatalyst_3850-48p-eMatch-

ciscocatalyst_3850-48p-lMatch-

ciscocatalyst_3850-48p-sMatch-

ciscocatalyst_3850-48pw-sMatch-

ciscocatalyst_3850-48t-eMatch-

ciscocatalyst_3850-48t-lMatch-

ciscocatalyst_3850-48t-sMatch-

ciscocatalyst_3850-48uMatch-

ciscocatalyst_3850-48u-eMatch-

ciscocatalyst_3850-48u-lMatch-

ciscocatalyst_3850-48u-sMatch-

ciscocatalyst_3850-48xsMatch-

ciscocatalyst_3850-48xs-eMatch-

ciscocatalyst_3850-48xs-f-eMatch-

ciscocatalyst_3850-48xs-f-sMatch-

ciscocatalyst_3850-48xs-sMatch-

ciscocatalyst_3850-nm-2-40gMatch-

ciscocatalyst_3850-nm-8-10gMatch-

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.036 Low

EPSS

Percentile

91.8%

JSON

Related for NVD:CVE-2023-20273

prion2 cve2 githubexploit1 cnvd1 cvelist2 cisco1 attackerkb2 metasploit2 zdt2 nvd1 packetstorm1 nessus1 ics1 thn2 cisa_kev1 talosblog1 rapid7blog2