Actively exploited in the wild
Cisco IOS XE Web UI Privilege Escalation Vulnerability
Cisco - IOS XE Web UI · Listed in the CISA KEV since 2023-10-16. This indicates confirmed attacks in production environments.
Required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
CVE-2023-20198
CriticalCVSS 10.0KEVSummary
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. The attacker exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user, then exploited another component (CVE-2023-20273) to elevate privilege to root and write an implant. CVE-2023-20198 has a CVSS score of 10.0, CVE-2023-20273 has a CVSS score of 7.2.
Risk Assessment
An attacker can gain full control of the Cisco IOS XE device, potentially leading to network traffic interception, configuration modification, and persistent presence in the network.
Recommendation
Apply available patches from Cisco for IOS XE Software. Check devices for signs of compromise and restrict access to the web UI to trusted networks only.
Other vulnerabilities in Cisco IOS XE Software
See all- CVE-2026-20104Medium
A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200, ESS9300, IE9310, IE9320, IE3500, and IE3505 switches could allow an authenticated local attacker with level-15 privileges or an unauthenticated attacker with physical access to execute arbitrary code at boot time and break the chain of trust. This is due to insufficient validation of software at boot time, enabling manipulation of loaded binaries to bypass integrity checks.
- CVE-2026-20272Critical
As part of an internal security review in Cisco IOS XE Software, multiple vulnerabilities related to improper neutralization of special elements (CWE-74) were discovered. Hardened software releases addressing these issues have been issued.
- CVE-2026-20267Critical
Vulnerability in Cisco IOS XE Software, discovered during an internal security review, involves improper access control issues classified under CWE-284. Hardened releases have been issued as a result.
- CVE-2023-20273HighActively exploited
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This is due to insufficient input validation.
- CVE-2017-12319MediumActively exploited
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations.
- CVE-2017-12229Critical
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 allows an unauthenticated remote attacker to bypass authentication to the REST API. The issue is due to insufficient input validation for the REST API.
- CVE-2026-20311Medium
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This is due to insufficient error handling in the web-based management interface. An attacker could exploit this by authenticating with a malformed certificate, potentially causing the device to reload.
- CVE-2026-20308Medium
A vulnerability in the web-based management interface of Cisco IOS XE Software allows an authenticated remote attacker with low privileges to perform a DoS attack. The issue is due to insufficient input validation, and exploitation can make the interface unresponsive.
- CVE-2026-20273High
A vulnerability in Cisco IOS XE Software related to improper input validation (CWE-20), discovered during an internal security review. It is addressed in a software hardening release.
- CVE-2026-20271High
A vulnerability in Cisco IOS XE Software related to insufficient control flow management (CWE-691), discovered during an internal security review. It is addressed in software hardening releases.
Original NVD description (English source)
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS