SB2023101701 - Multiple vulnerabilities in Cisco IOS XE Web UI software 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023101701

SB2023101701 - Multiple vulnerabilities in Cisco IOS XE Web UI software

Published: October 17, 2023 Updated: April 18, 2025

Security Bulletin ID SB2023101701
Severity
Critical
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 50% High 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper Privilege Management (CVE-ID: CVE-2023-20198)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper privilege management in the web UI feature. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected device and create an account with privilege level 15 access.

Note, the vulnerability is being actively exploited in the wild.


2) Improper Privilege Management (CVE-ID: CVE-2023-20273)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper privilege management in the web UI feature. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected device and create an account with privilege level 15 access.

Note, the vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

References