ACTIEF MISBRUIKT
CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability
| Leverancier | Cisco |
|---|---|
| Product | IOS XE Web UI |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 16 okt 2023 |
| CISA-deadline (Amerikaanse overheid) | 20 okt 2023 |
| Zwakte (CWE) | CWE-420 |
Vereiste actie (tekst van CISA, Engels)
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Beschrijving (NVD, Engels)
Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.
BRONNEN
Andere lekken bij Cisco
- CVE-2026-20320: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
- CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.