---
id: "CVE-2023-20273"
kind: "vulnerability"
aliases: ["CVE-2023-20273"]
title: "A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to\u2026"
severity: "critical"
cvss: 7.2
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco Cisco IOS XE Web UI", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.1.1", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.1.2", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.1.3", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.2.1", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.2.2", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.1a", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.2", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.3", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.4", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.5", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.5b", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.6", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.7", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.8", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.9", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.10", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.3.11", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.4.1", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.4.2", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.4.3", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.5.1", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.5.1a", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.5.1b", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.5.2", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.5.3", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.1", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.2", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.3", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.4", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.4a", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.5", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.5a", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.6", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.7", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.8", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.9", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.6.10", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.7.1", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.7.1a", "ecosystem": "vendor"}, {"name": "cisco ios xe", "fixed": [], "affected": "= 16.7.1b", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "exploited", "infrastructure", "ios-xe", "network-devices", "self-hosted"]
not_affected_if: ["no-internet-exposure", "web-ui-disabled"]
published_at: "2023-10-23T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20273", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to…

Cisco IOS XE's web user interface has a command injection flaw that lets an attacker run commands on the device. Chained with CVE-2023-20198, an attacker creates a local admin account, escalates to root, and writes a persistent implant to the file system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco Cisco IOS XE Web UI affected ? fixed ?
- vendor:cisco ios xe affected = 16.1.1 fixed ?
- vendor:cisco ios xe affected = 16.1.2 fixed ?
- vendor:cisco ios xe affected = 16.1.3 fixed ?
- vendor:cisco ios xe affected = 16.2.1 fixed ?
- vendor:cisco ios xe affected = 16.2.2 fixed ?
- vendor:cisco ios xe affected = 16.3.1a fixed ?
- vendor:cisco ios xe affected = 16.3.2 fixed ?
- vendor:cisco ios xe affected = 16.3.3 fixed ?
- vendor:cisco ios xe affected = 16.3.4 fixed ?
- vendor:cisco ios xe affected = 16.3.5 fixed ?
- vendor:cisco ios xe affected = 16.3.5b fixed ?
- vendor:cisco ios xe affected = 16.3.6 fixed ?
- vendor:cisco ios xe affected = 16.3.7 fixed ?
- vendor:cisco ios xe affected = 16.3.8 fixed ?
- vendor:cisco ios xe affected = 16.3.9 fixed ?
- vendor:cisco ios xe affected = 16.3.10 fixed ?
- vendor:cisco ios xe affected = 16.3.11 fixed ?
- vendor:cisco ios xe affected = 16.4.1 fixed ?
- vendor:cisco ios xe affected = 16.4.2 fixed ?
- vendor:cisco ios xe affected = 16.4.3 fixed ?
- vendor:cisco ios xe affected = 16.5.1 fixed ?
- vendor:cisco ios xe affected = 16.5.1a fixed ?
- vendor:cisco ios xe affected = 16.5.1b fixed ?
- vendor:cisco ios xe affected = 16.5.2 fixed ?
- vendor:cisco ios xe affected = 16.5.3 fixed ?
- vendor:cisco ios xe affected = 16.6.1 fixed ?
- vendor:cisco ios xe affected = 16.6.2 fixed ?
- vendor:cisco ios xe affected = 16.6.3 fixed ?
- vendor:cisco ios xe affected = 16.6.4 fixed ?
- vendor:cisco ios xe affected = 16.6.4a fixed ?
- vendor:cisco ios xe affected = 16.6.5 fixed ?
- vendor:cisco ios xe affected = 16.6.5a fixed ?
- vendor:cisco ios xe affected = 16.6.6 fixed ?
- vendor:cisco ios xe affected = 16.6.7 fixed ?
- vendor:cisco ios xe affected = 16.6.8 fixed ?
- vendor:cisco ios xe affected = 16.6.9 fixed ?
- vendor:cisco ios xe affected = 16.6.10 fixed ?
- vendor:cisco ios xe affected = 16.7.1 fixed ?
- vendor:cisco ios xe affected = 16.7.1a fixed ?
- vendor:cisco ios xe affected = 16.7.1b fixed ?

## Fix

Follow Cisco's vendor advisory for CVE-2023-20273 and apply the listed fixed release or mitigation; CISA BOD 23-02 applies to federal agencies.
If the web UI was exposed to the internet or untrusted networks, follow vendor instructions to check for compromise and report positive findings to CISA.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-20273

## From the sources

Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.

CISA required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_