Skip to content
Fencer Vulns
high 7.2

CVE-2023-20076 json

Cisco IOx Application Hosting Environment Command Injection Vulnerability

published 2023-02-12 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24255

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system.

Patch / fix

  • cisco ios_xe 17.6.5, 17.9.2
  • cisco cgr1240_firmware 1.16.0.1
  • cisco cgr1000_firmware 1.16.0.1
  • cisco ir510_wpan_firmware 1.10.0.1
  • cisco 829_industrial_integrated_services_router_firmware 15.9\(3\)
  • cisco 807_industrial_integrated_services_router_firmware 15.9\(3\)
  • cisco 809_industrial_integrated_services_router_firmware 15.9\(3\)
  • cisco ic3000_industrial_compute_gateway 1.4.2

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.51% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Cisco Cisco IOS

Classification

Weakness
  • CWE-233 Improper Handling of Parameters
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.