CVE-2023-20273
HIGHCVSS v3
7.2
HIGH
EPSS Score
92.4%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Technical Details
- Published
- 10/25/2023
Frequently Asked Questions
What is CVE-2023-20273?
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Is CVE-2023-20273 actively exploited?
Active exploitation of CVE-2023-20273 has not been confirmed. The EPSS score is 92.4%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2023-20273?
CVE-2023-20273 has a CVSS v3 base score of 7.2 (HIGH severity).
Is CVE-2023-20273 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.