Actively exploited in the wild
Cisco IOS XE Web UI Command Injection Vulnerability
Cisco - Cisco IOS XE Web UI · Listed in the CISA KEV since 2023-10-23. This indicates confirmed attacks in production environments.
Required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
CVE-2023-20273
HighCVSS 7.2KEVSummary
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This is due to insufficient input validation.
Risk Assessment
An attacker could inject commands to the underlying operating system with root privileges, potentially leading to full device compromise.
Recommendation
Update Cisco IOS XE Software to the version containing the fix.
Other vulnerabilities in Cisco IOS XE Software
See all- CVE-2026-20272Critical
As part of an internal security review in Cisco IOS XE Software, multiple vulnerabilities related to improper neutralization of special elements (CWE-74) were discovered. Hardened software releases addressing these issues have been issued.
- CVE-2026-20267Critical
As part of an internal security review in Cisco IOS XE Software, multiple vulnerabilities related to improper access control (CWE-284) were discovered. Hardened software releases addressing these issues have been issued.
- CVE-2023-20198CriticalActively exploited
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. The attacker exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user, then exploited another component (CVE-2023-20273) to elevate privilege to root and write an implant. CVE-2023-20198 has a CVSS score of 10.0, CVE-2023-20273 has a CVSS score of 7.2.
- CVE-2017-12229Critical
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 allows an unauthenticated remote attacker to bypass authentication to the REST API. The issue is due to insufficient input validation for the REST API.
- CVE-2026-20311Medium
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This is due to insufficient error handling in the web-based management interface. An attacker could exploit this by authenticating with a malformed certificate, potentially causing the device to reload.
- CVE-2026-20308Medium
A vulnerability in the web-based management interface of Cisco IOS XE Software allows an authenticated remote attacker with low privileges to perform a DoS attack. The issue is due to insufficient input validation, and exploitation can make the interface unresponsive.
- CVE-2026-20273High
A vulnerability in Cisco IOS XE Software related to improper input validation (CWE-20), discovered during an internal security review. It is addressed in a software hardening release.
- CVE-2026-20271High
A vulnerability in Cisco IOS XE Software related to insufficient control flow management (CWE-691), discovered during an internal security review. It is addressed in software hardening releases.
- CVE-2026-20270High
A vulnerability in Cisco IOS XE Software related to incorrect calculation issues (CWE-682), discovered during an internal security review. It is addressed in software hardening releases.
- CVE-2026-20269High
A vulnerability in Cisco IOS XE Software related to improper control of a resource through its lifetime (CWE-664), discovered during an internal security review. It is addressed in software hardening releases.
Original NVD description (English source)
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.