CVE-2023-20273Vulnerability
Cisco IOS XE Web UI Command Injection Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by GreyNoise · last reported
Last reported 29 days ago
CISA KEVAdded 23 Oct 2023
Fix due 27 Oct 2023
Used by ransomware: not knownCISA KEV catalogue
Fix due 27 Oct 2023
Used by ransomware: not knownCISA KEV catalogue
EPSS93.0%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions“…re, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieve root-level code execution.”
-
GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks“…same period when Salt Typhoon, a Chinese state-sponsored threat group, reportedly breached telecom networks using CVE-2023-20198 and CVE-2023-20273.”
Indicators reported together
named in the same reports- hxxps://www.wyden.senate[.]gov/imo/media/doc/wyden-schmitt_dod_letter.pdfin 1 report
- hxxps://docs.fcc[.]gov/public/attachments/DOC-402579A1.pdfin 1 report
- hxxps://www.washingtonpost[.]com/national-security/2024/11/21/salt-typhoon-china-hack-telecom/in 1 report
- hxxps://docs.fcc[.]gov/public/attachments/FCC-24-62A1.pdfin 1 report
- hxxps://www.uscc[.]gov/sites/default/files/annual_reports/2010-Report-to-Congress.pdfin 1 report
- www.uscc[.]govin 1 report
Copy these 6 indicators · defanged
Also named with it: CVE-2023-20198, CVE-2024-3400, CVE-2024-21887, CVE-2023-46805, CVE-2018-0171
Thanks — we review every report.