CVE-2023-20231

View on CVE.org
Published Sep 27, 2023 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device.

This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to execute arbitrary Cisco IOS XE Software CLI commands with level 15 privileges.

Note: This vulnerability is exploitable only if the attacker obtains the credentials for a Lobby Ambassador account. This account is not configured by default.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-24410 A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to execute arbitrary Cisco IOS XE Software CLI commands with level 15 privileges. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a Lobby Ambassador account. This account is not configured by default.
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Cisco ios Xe Software
CPEs cpe:2.3:a:cisco:ios_xe_software:*:*:*:*:*:*:*:*
Vendors & Products Cisco ios Xe Software
Metrics ssvc

{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}

Subscriptions

Cisco Catalyst 9105ax Catalyst 9105axi Catalyst 9105axw Catalyst 9115ax Catalyst 9115axe Catalyst 9115axi Catalyst 9117ax Catalyst 9117axi Catalyst 9120ax Catalyst 9120axe Catalyst 9120axi Catalyst 9120axp Catalyst 9124ax Catalyst 9124axd Catalyst 9124axi Catalyst 9130ax Catalyst 9130axe Catalyst 9130axi Catalyst 9300 Catalyst 9300-24p-a Catalyst 9300-24p-e Catalyst 9300-24s-a Catalyst 9300-24s-e Catalyst 9300-24t-a Catalyst 9300-24t-e Catalyst 9300-24u-a Catalyst 9300-24u-e Catalyst 9300-24ux-a Catalyst 9300-24ux-e Catalyst 9300-48p-a Catalyst 9300-48p-e Catalyst 9300-48s-a Catalyst 9300-48s-e Catalyst 9300-48t-a Catalyst 9300-48t-e Catalyst 9300-48u-a Catalyst 9300-48u-e Catalyst 9300-48un-a Catalyst 9300-48un-e Catalyst 9300-48uxm-a Catalyst 9300-48uxm-e Catalyst 9300l Catalyst 9300l-24p-4g-a Catalyst 9300l-24p-4g-e Catalyst 9300l-24p-4x-a Catalyst 9300l-24p-4x-e Catalyst 9300l-24t-4g-a Catalyst 9300l-24t-4g-e Catalyst 9300l-24t-4x-a Catalyst 9300l-24t-4x-e Catalyst 9300l-48p-4g-a Catalyst 9300l-48p-4g-e Catalyst 9300l-48p-4x-a Catalyst 9300l-48p-4x-e Catalyst 9300l-48t-4g-a Catalyst 9300l-48t-4g-e Catalyst 9300l-48t-4x-a Catalyst 9300l-48t-4x-e Catalyst 9300l Stack Catalyst 9300lm Catalyst 9300x Catalyst 9400 Catalyst 9407r Catalyst 9410r Catalyst 9500 Catalyst 9500h Catalyst 9800 Catalyst 9800-40 Catalyst 9800-80 Catalyst 9800-cl Catalyst 9800-l Catalyst 9800-l-c Catalyst 9800-l-f Ios Xe Ios Xe Software
Weaknesses

Sources

Status
PUBLISHED
Assigner
cisco
Published
Updated
Dec 16, 2025, 6:23 PM
Reserved
Oct 27, 2022, 6:47 PM

View source JSON

Updated
Aug 2, 2024, 9:05 AM

JSON

Status
Modified
Published
Sep 27, 2023, 6:15 PM
Modified
Jun 17, 2026, 5:29 AM

View source JSON

No data.

No data.