Description

The Cisco IOS XE Web UI has an authentication bypass vulnerability. An unauthenticated attacker can bypass the authentication with a specially crafted HTTP request and get full access to the system.

Remediation

Upgrade to the latest version of Cisco IOS XE

References

Cisco IOS XE Software Web UI Privilege Escalation Vulnerability

Cisco IOS XE CVE-2023-20198: Deep Dive and POC

Related Vulnerabilities

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-5012)

Jboss EAP Improper Restriction of XML External Entity Reference Vulnerability (CVE-2019-10172)

MySQL CVE-2024-21101 Vulnerability (CVE-2024-21101)

XWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2022-41932)

OpenSSL Out-of-bounds Write Vulnerability (CVE-2023-6129)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Tags

Authentication Bypass Known Vulnerabilities CWE-287 CVE-2023-20198