What is CVE-2023-20273?

CVE-2023-20273 is a high-severity vulnerability affecting the web UI feature of Cisco IOS XE Software, which is used in various Cisco Catalyst switches and network modules. This vulnerability allows an authenticated, remote attacker to inject commands with root privileges due to insufficient input validation. By exploiting this vulnerability, an attacker could gain unauthorized access to the underlying operating system, posing a significant risk to affected systems.

Who is impacted?

The CVE-2023-20273 vulnerability affects users of Cisco IOS XE Software with the web UI feature. Specifically, impacted versions include Cisco IOS XE Software versions from 17.3 up to (excluding) 17.3.8a, versions from 17.6 up to (excluding) 17.6.6a, versions from 17.9 up to (excluding) 17.9.4a, and versions from 16.12 up to (excluding) 16.12.10a. This vulnerability could allow an attacker to inject commands with root privileges, posing a significant risk to affected systems.

What to do if CVE-2023-20273 affected you

If you're affected by the CVE-2023-20273 vulnerability, it's crucial to take immediate action to protect your systems. Follow these simple steps to mitigate the risk:

1. Identify affected systems running Cisco IOS XE Software with the web UI feature.

2. Update to the latest, patched version of the software.

3. Consider implementing additional security measures, such as network segmentation or isolation, as recommended by CISA's BOD 22-01.

4. Monitor your systems for any signs of unauthorized access or suspicious activity.

Is it in CISA’s Known Exploited Vulnerabilities Catalog?

The Cisco IOS XE Web UI Command Injection Vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on October 23, 2023, with a due date of October 27, 2023. The required action is to verify compliance with BOD 23-02 and apply mitigations as per vendor instructions. In simple terms, this means organizations need to ensure their systems are up-to-date and follow the recommended steps to protect against this vulnerability.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-78, which involves improper neutralization of special elements used in an OS command, also known as OS command injection.

Learn More

CVE-2023-20273 is a significant vulnerability affecting Cisco IOS XE Software's web UI feature, posing a considerable risk to affected systems. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• NVD - CVE-2023-20273

• Cisco Security Advisory

• CISA - BOD 22-01

• CISA - Known Exploited Vulnerabilities Catalog