CVE-2023-20273

Cisco IOS XE Web UI Command Injection Vulnerability

Published Oct 23, 2023 · updated Jun 16, 2026 · cisco ios xe

Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.

Timeline

Detection, updates, and resolution for this record.

Oct 23, 2023 · Catalog
Detected
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer b
Oct 23, 2023 · CISA KEV
Known exploited
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Oct 27, 2023 · CISA KEV
Remediation due
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Jun 16, 2026 · Catalog
Updated
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer b

Required action

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

CISA due date Oct 27, 2023

Affected

cpe cisco/ios xeversion unspecified
cpe cisco/ios xe16.1.1
cpe cisco/ios xe16.1.2
cpe cisco/ios xe16.1.3
cpe cisco/ios xe16.2.1
cpe cisco/ios xe16.2.2
cpe cisco/ios xe16.3.1a
cpe cisco/ios xe16.3.2
cpe cisco/ios xe16.3.3
vendor Cisco Cisco IOS XE Web UIversion unspecified

Sources

CISA KEVCVE-2023-20273
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer b
cisa.gov
CVE.orgCVE-2023-20273
Official CVE identifier
cve.org
FIRST EPSSCVE-2023-20273
30-day exploitation probability 89.6%
first.org
Metasploit Modulesauxiliary_admin/http/cisco_ios_xe_os_exec_cve_2023_20273
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com
Metasploit Modulesexploit_linux/misc/cisco_ios_xe_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDCVE-2023-20273
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted
nvd.nist.gov