Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 89.6%; technical severity is CVSS 7.2.
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Who should care
- Teams operating Cisco IOS XE Web UI, Ios Xe
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Cisco IOS XE Web UI, Ios Xe is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Cisco Security advisory Cisco Sa Iosxe Webui Privesc J22SaA4z
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Verification noteAutomated link verification has not completed for this guidance yet.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-78
- Affected versions
- Cisco Cisco IOS XE Web UI; Cisco Ios Xe (Version 16.1.1 | Version 16.1.2 | Version 16.1.3 | Version 16.2.1)
- Fixed versions
- Cisco Ios Xe (Fixed from 17.3.8a, 17.6.6a, 17.9.4a, 16.12.10a)
- Published
- 25 October 2023
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 89.6%
- Signal calculated at 81