Unrated severityCISA KEVNVD Advisory· Published Oct 24, 2023· Updated Oct 21, 2025

CVE-2023-20273

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cisco Systems, Inc./iOS Xr Softwarellm-fuzzy
Cisco Systems, Inc./IOS XE Software for Cisco Merakicpe-rescue
Range: 16.1.1

Patches

Vulnerability mechanics

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4zmitre

News mentions

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect
Tenable Blog · May 27, 2026

cvss	0.000
epss	0.072
exploit	0.030
kev	0.120
patch	0.000
ransomware	0.000