Cisco IOS XE Web UI Command Injection Vulnerability
CISA lists this Cisco Cisco IOS XE Web UI vulnerability as known exploited. The vendor's advisory has the fixed versions.
CISA catalog record
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.
- Product
- Cisco IOS XE Web UI
- Added to KEV
- 23 Oct 2023
- Federal remediation due
- 27 Oct 2023
- Known ransomware use
- Not reported
What changed
First observed 14 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.