IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.2Yüksek KEV

CVE-2023-20273Cisco IOS XE Web UI Command Injection Vulnerability

Cisco Cisco IOS XE Software Yayım: (3 yıl önce)

Aktif olarak istismar ediliyor — Cisco IOS XE Web UI Command Injection Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 23.10.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 27.10.2023.

Gerekli işlem: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z; https://nvd.nist.gov/vuln/detail/CVE-2023-20273

Açıklama

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Zayıflık türü (CWE): CWE-78

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Cisco Cisco IOS XE Software 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4, 16.3.5, 16.3.5b, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.3.10, 16.3.11, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.2, 16.6.3, 16.6.4, 16.6.5, 16.6.4a, 16.6.5a, 16.6.6, 16.6.7, 16.6.8, 16.6.9, 16.6.10, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1s, 16.8.1c, 16.8.1d, 16.8.2, 16.8.1e, 16.8.3, 16.9.1, 16.9.2, 16.9.1a, 16.9.1b, 16.9.1s, 16.9.3, 16.9.4, 16.9.3a, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8, 16.10.1, 16.10.1a, 16.10.1b, 16.10.1s, 16.10.1c, 1
cisco ios xe 16.1.1

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (60)
  • cpe:2.3:o:cisco:ios_xe:16.1.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.1.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.1.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.2.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.2.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.1a:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.4:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.5:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.5b:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.6:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.7:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.8:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.9:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.10:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.3.11:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.4.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.4.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.4.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.5.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.5.1a:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.5.1b:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.5.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.5.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.4:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.4a:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.5:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.5a:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.6:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.7:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.8:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.9:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.6.10:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.7.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.7.1a:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.7.1b:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.7.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.7.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.1a:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.1b:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.1c:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.1d:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.1e:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.1s:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.8.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.9.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.9.1a:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.9.1b:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.9.1s:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.9.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.9.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.9.3a:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xe:16.9.4:*:*:*:*:*:*:*

Aynı üründe son açıklar — Cisco IOS / IOS XE / ASA

8.6Yüksek
CVE-2026-76418 KEV

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unex…

5.3Orta
CVE-2026-76445

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulner…

7.5Yüksek
CVE-2026-20356

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…

7.5Yüksek
CVE-2026-20236

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…