#VU82295 Improper Privilege Management in Cisco IOS XE - CVE-2023-20273

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU82295

#VU82295 Improper Privilege Management in Cisco IOS XE - CVE-2023-20273

Published: October 23, 2023 / Updated: December 18, 2023


Vulnerability identifier: #VU82295
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2023-20273
CWE-ID: CWE-269
Exploitation vector: Local access
Exploit availability: The vulnerability is being exploited in the wild
Vulnerable software:
Cisco IOS XE
Software vendor:
Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper privilege management in the web UI feature. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected device and create an account with privilege level 15 access.

Note, the vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

External links