Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-20273

96
FAUCET Score

CVE-2023-20273 is a critical command injection vulnerability in the web UI of Cisco IOS XE Software, allowing authenticated remote attackers to execute commands with root privileges due to insufficient input validation. This vulnerability carries a CVSS score of 7.2 (HIGH) and allows for full compromise of confidentiality, integrity, and availability. It is actively exploited in the wild, with an EPSS score indicating high exploitability and multiple Metasploit modules available. The vulnerability has garnered significant community attention and media coverage, including links to state-sponsored threat actors.

Impacted Technologies

VendorProductVersion(s)CPE
16.1.1CPE matchmatch criteria
cpe:2.3:o:cisco:ios_xe:16.1.1:*:*:*:*:*:*:*
16.1.2CPE matchmatch criteria
cpe:2.3:o:cisco:ios_xe:16.1.2:*:*:*:*:*:*:*
16.1.3CPE matchmatch criteria
cpe:2.3:o:cisco:ios_xe:16.1.3:*:*:*:*:*:*:*
16.2.1CPE matchmatch criteria
cpe:2.3:o:cisco:ios_xe:16.2.1:*:*:*:*:*:*:*
16.2.2CPE matchmatch criteria
cpe:2.3:o:cisco:ios_xe:16.2.2:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.2HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.2
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
89.63%
Probability of exploitation in next 30 days
EPSS Percentile
99.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
Added to KEV · Oct 23, 2023
Metasploit: Cisco IOX XE Unauthenticated RCE Chain · Oct 16, 2023
This CVE's current EPSS score of 0.8963 is in the 100th percentile among its peer group of 5,537 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (1)

ciscovendor investigatingvia nvd_reference
View patch

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
sec.cloudapps.cisco.com / security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
Vendor Advisory