CVE-2023-20273

Katalog CVE

CVSS 7.2 · High KEV · sudah dieksploitasi EPSS 89,6%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada cisco ios xe. Skor CVSS 3.1 7.2 (High) menurut NVD. Masuk katalog KEV CISA pada 23 Oktober 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Rincian

Terbit di NVD

25 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

89,6% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Cisco IOS XE Web UI Command Injection Vulnerability

Masuk KEV

23 Oktober 2023

Tenggat CISA

27 Oktober 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 189 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22... advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20273 pemerintah AS