Cisco IOS XE Web UI Command Injection Vulnerability
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating syste
What happened
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
CISA lists it as exploited, added 23 Oct 2023.
Does it affect you
Names Cisco IOS XE. Enter the product and version you run to place it against the affected range the vendor published.
What to do
- Follow the vendor advisory for the fixed release and any interim mitigation.
sec.cloudapps.cisco.com - Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
cisa.gov
CISA’s notes for this entry:
Affected, as published to NVD
- cisco-iosxe
- Cisco IOS XE: 17.3 up to the fix in 17.3.8a
The record
- NVD status
- Analyzed
- Published
- 25 Oct 2023, last modified 17 Jun 2026 (NVD)
- Severity
- CVSS 3.1 base score 7.2, High — computed here from the vector; NVD states 7.2.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (NVD; names by MITRE)
- Exploitation
- Listed in CISA’s Known Exploited Vulnerabilities catalogue since 23 Oct 2023; federal remediation due 27 Oct 2023. CISA entry
- Vendor
- Cisco · Cisco IOS XE Web UI (CISA)
References on the NVD record
Sources
The verdict above is computed from the products and versions you entered and the affected ranges the vendor published to NVD. It does not inspect your environment, and this site never reports a product as unaffected: why.