Live › vulnerability › CVE-2023-20273
Go to dashboardCisco IOS XE's web user interface has a command injection flaw that lets an attacker run commands on the device. Chained with CVE-2023-20198, an attacker creates a local admin account, escalates to root, and writes a persistent implant to the file system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco Cisco IOS XE Web UI | vendor | – | – |
| cisco ios xe | vendor | = 16.1.1 | – |
| cisco ios xe | vendor | = 16.1.2 | – |
| cisco ios xe | vendor | = 16.1.3 | – |
| cisco ios xe | vendor | = 16.2.1 | – |
| cisco ios xe | vendor | = 16.2.2 | – |
| cisco ios xe | vendor | = 16.3.1a | – |
| cisco ios xe | vendor | = 16.3.2 | – |
| cisco ios xe | vendor | = 16.3.3 | – |
| cisco ios xe | vendor | = 16.3.4 | – |
| cisco ios xe | vendor | = 16.3.5 | – |
| cisco ios xe | vendor | = 16.3.5b | – |
| cisco ios xe | vendor | = 16.3.6 | – |
| cisco ios xe | vendor | = 16.3.7 | – |
| cisco ios xe | vendor | = 16.3.8 | – |
| cisco ios xe | vendor | = 16.3.9 | – |
| cisco ios xe | vendor | = 16.3.10 | – |
| cisco ios xe | vendor | = 16.3.11 | – |
| cisco ios xe | vendor | = 16.4.1 | – |
| cisco ios xe | vendor | = 16.4.2 | – |
| cisco ios xe | vendor | = 16.4.3 | – |
| cisco ios xe | vendor | = 16.5.1 | – |
| cisco ios xe | vendor | = 16.5.1a | – |
| cisco ios xe | vendor | = 16.5.1b | – |
| cisco ios xe | vendor | = 16.5.2 | – |
| cisco ios xe | vendor | = 16.5.3 | – |
| cisco ios xe | vendor | = 16.6.1 | – |
| cisco ios xe | vendor | = 16.6.2 | – |
| cisco ios xe | vendor | = 16.6.3 | – |
| cisco ios xe | vendor | = 16.6.4 | – |
| cisco ios xe | vendor | = 16.6.4a | – |
| cisco ios xe | vendor | = 16.6.5 | – |
| cisco ios xe | vendor | = 16.6.5a | – |
| cisco ios xe | vendor | = 16.6.6 | – |
| cisco ios xe | vendor | = 16.6.7 | – |
| cisco ios xe | vendor | = 16.6.8 | – |
| cisco ios xe | vendor | = 16.6.9 | – |
| cisco ios xe | vendor | = 16.6.10 | – |
| cisco ios xe | vendor | = 16.7.1 | – |
| cisco ios xe | vendor | = 16.7.1a | – |
| cisco ios xe | vendor | = 16.7.1b | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.
CISA required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
This page as .md · .json · in your agent: get_signal("CVE-2023-20273")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.