CVE-2023-20273

What it actually does

The flaw is an authenticated command injection vulnerability in the Cisco IOS XE web UI. Because the web UI insufficiently validates attacker-controlled input, a remote attacker with high-privileged web UI credentials can pass crafted input that is executed by the underlying operating system with root privileges. Successful exploitation can allow full device compromise, including arbitrary command execution, persistence, configuration modification, traffic interception, and deployment of additional tooling or implants on the network device.

Why it matters to the business

Compromise of an IOS XE device can affect a critical network control point such as a switch, router, or wireless infrastructure component. An attacker with root-level control may disrupt connectivity, alter routing or switching behavior, capture or redirect traffic, create unauthorized administrative access, and use the device as a foothold into internal networks. This vulnerability is in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score, so organizations should treat exposed or internet-reachable web UI services as high-priority risk even though exploitation requires authenticated access.

How an attack unfolds

An attacker first identifies Cisco IOS XE devices with the HTTP or HTTPS web UI enabled, especially devices reachable from untrusted networks. The attacker then obtains or creates high-privileged web UI access, which may occur through stolen credentials, weak administrative controls, or chaining with another vulnerability. Once authenticated, the attacker sends crafted input to the web UI that is not properly sanitized. The web UI passes that input to the underlying operating system, resulting in command execution as root. With root execution, the attacker can inspect and modify device state, add or alter accounts, deploy a web implant or other persistence mechanism, collect configuration and credential material, pivot through the network, or disrupt device operation. Public reporting around this activity has associated exploitation with IOS XE web UI compromise campaigns, including chains where an initial web UI access vulnerability was used before command injection to install an implant.

How to fix it

Upgrade affected Cisco IOS XE devices to a Cisco fixed release that addresses CVE-2023-20273. Cisco has not provided fixed version details in the supplied input, so use the Cisco Software Checker and the official Cisco advisory to identify the exact fixed release for each platform and train. If immediate upgrade is not possible, disable the IOS XE web UI by removing `ip http server` and `ip http secure-server` where operationally feasible. Restrict management access to trusted administrative networks only, enforce MFA or strong administrative authentication where supported, rotate privileged credentials, and audit local users and configuration changes. Do not expose the web UI directly to the internet. Because this vulnerability is in CISA KEV with a remediation due date of 2023-10-27 and is actively exploited, remediation should be prioritized above routine patch cycles.

How to confirm the fix worked

Confirm that each affected device is running a Cisco IOS XE release identified by Cisco as fixed for this vulnerability. Verify that HTTP/HTTPS management services are disabled unless strictly required by checking for `ip http server` and `ip http secure-server` in the running configuration. If the web UI must remain enabled, verify that access control lists, management VRFs, firewalls, or other controls restrict access to trusted administrative sources only. Review device configuration for unauthorized local users, unexpected privilege 15 accounts, unusual AAA changes, suspicious web UI activity, and unexplained configuration changes. Validate externally that the web UI is not reachable from the public internet or other untrusted segments. Where compromise is suspected, follow Cisco incident response guidance, collect forensic artifacts before rebooting when possible, and consider device reimaging or replacement if integrity cannot be established.

Typical attack path

1. Scan for Cisco IOS XE devices with the web UI exposed over HTTP or HTTPS.
2. Confirm that the target runs an affected IOS XE release and that the web UI is enabled.
3. Obtain high-privileged web UI access through stolen credentials, misconfiguration, or vulnerability chaining.
4. Send crafted input to a vulnerable web UI endpoint to trigger command injection.
5. Execute commands on the underlying operating system with root privileges.
6. Establish persistence by modifying configuration, adding accounts, or deploying an implant.
7. Collect device configuration, credentials, routing data, or network metadata.
8. Use the compromised network device for traffic interception, lateral movement, command-and-control relay, or service disruption.

How to detect it

Review IOS XE device logs, AAA logs, TACACS+/RADIUS logs, web management access logs if exported, SIEM records, NetFlow, firewall logs, and configuration archives for evidence of unauthorized web UI access or post-exploitation activity. Focus on unusual HTTP/HTTPS management access from non-administrative IP addresses, successful administrative logins outside normal change windows, creation of unexpected local users, changes to AAA or privilege levels, activation or reactivation of HTTP/HTTPS server features, and unexplained configuration changes. Search for signs associated with IOS XE web UI compromise campaigns, including suspicious access to web UI endpoints, implant-check requests, and anomalous files or processes on the underlying IOS XE Linux environment. Compare running configuration against known-good backups. Investigate any device that returned unexpected output to Cisco-recommended implant checks or that shows web UI activity followed by configuration changes, new users, or abnormal outbound connections. Because exploitation may involve chaining with other IOS XE web UI vulnerabilities, treat unauthorized privilege 15 account creation and web UI command execution artifacts as high-confidence indicators requiring full device integrity review.

• /webui/
• /webui/logoutconfirm.html
• logoutconfirm.html?logon_hash=
• cisco_tac_admin
• cisco_support
• %SYS-5-CONFIG_P: Configured programmatically
• SEP_webui_wsma_http
• ip http server
• ip http secure-server
• username cisco_tac_admin privilege 15
• username cisco_support privilege 15
• /usr/binos/conf/nginx-conf/cisco_service.conf
• cisco_service.conf

What your security team should do

• Immediately inventory Cisco IOS XE devices and identify systems with the web UI enabled, especially internet-facing management interfaces.
• Patch affected devices to a Cisco fixed IOS XE release or disable the web UI if it is not operationally required.
• Restrict management-plane access to trusted administrative networks and remove public internet exposure for HTTP/HTTPS device management.
• Audit device logs and configurations for unauthorized users, privilege escalation, implant indicators, and unexplained configuration changes since at least October 2023.
• Rotate privileged device credentials and review AAA, TACACS+/RADIUS, and local user configurations for abuse.
• Hunt for evidence of IOS XE web UI compromise using Cisco Talos and vendor-provided indicators, including implant checks and suspicious web UI requests.
• If signs of compromise are found, isolate the device management plane, preserve logs and forensic data, remove unauthorized accounts, rebuild or reimage the device from trusted media, and redeploy with a fixed release.
• Add continuous monitoring for web UI exposure, configuration drift, and unexpected management access attempts on network infrastructure.