CVE-2023-20198

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html; https://nvd.nist.gov/vuln/detail/CVE-2023-20198

Remediation deadline: October 20, 2023

Description

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

Timeline

Published:October 16th, 2023 12:00 AM

Last modified:October 16th, 2023 12:00 AM

Added to KEV:October 16th, 2023

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

Cisco

Products

IOS XE Web UI

Weaknesses (CWE)

CWE-420

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute