CVE-2023-20035— Cisco IOS XE SD-WAN Software Command Injection Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-20035
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco IOS XE SD-WAN Software Command Injection Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
表达式/命令分隔符转义处理不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco IOS XE SD-WAN Software 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco IOS XE SD-WAN Software是美国思科（Cisco）公司的一款应用于Cisco IOS XE 网络操作系统的用于网络管理（软件定义网络）的软件。 Cisco IOS XE SD-WAN Software 存在安全漏洞，该漏洞源于系统 CLI 的输入验证不充分。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco IOS XE Software | n/a | - |
II. Public POCs for CVE-2023-20035
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-20035
请登录查看更多情报信息。
Same Patch Batch · Cisco · 2023-03-23 · 18 CVEs total
| CVE-2023-20027 | 8.6 HIGH | Cisco IOS XE Software Virtual Fragmentation Reassembly Denial of Service Vulnerability |
| CVE-2023-20072 | 8.6 HIGH | Cisco IOS XE Software Fragmented Tunnel Protocol Packet Denial of Service Vulnerability |
| CVE-2023-20080 | 8.6 HIGH | Cisco IOS and IOS XE Software IPv6 DHCP (DHCPv6) Relay and Server Denial of Service Vulner |
| CVE-2023-20055 | 8.0 HIGH | Cisco DNA Center Privilege Escalation Vulnerability |
| CVE-2023-20065 | 7.8 HIGH | Cisco IOS XE Software 安全漏洞 |
| CVE-2023-20112 | 7.4 HIGH | Cisco Access Point Software Association Request Denial of Service Vulnerability |
| CVE-2023-20067 | 7.4 HIGH | Cisco IOS XE Software for Wireless LAN Controllers HTTP Client Profiling Denial of Service |
| CVE-2023-20100 | 6.8 MEDIUM | Cisco IOS XE Software for Wireless LAN Controllers CAPWAP Join Denial of Service Vulnerabi |
| CVE-2023-20081 | 6.8 MEDIUM | Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Softwar |
| CVE-2023-20113 | 6.5 MEDIUM | Cisco SD-WAN vManage Software Cross-Site Request Forgery Vulnerability |
| CVE-2023-20066 | 6.5 MEDIUM | Cisco IOS XE Software Web UI Path Traversal Vulnerability |
| CVE-2023-20056 | 6.5 MEDIUM | Cisco Access Point Software Denial of Service Vulnerability |
| CVE-2023-20082 | 6.1 MEDIUM | Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches Secure Boot Bypass Vulnerabi |
| CVE-2023-20097 | 4.6 MEDIUM | Cisco Access Point Software Command Injection Vulnerability |
| CVE-2023-20029 | 4.4 MEDIUM | Cisco IOS XE Software Privilege Escalation Vulnerability |
| CVE-2023-20059 | 4.3 MEDIUM | Cisco DNA Center Information Disclosure Vulnerability |
| CVE-2023-20107 | Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entro |
IV. Related Vulnerabilities
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-146
- CVE-2026-22266
Dell PowerProtect Data Manager（PPDM） 安全漏洞 - CVE-2025-53192
Apache Commons OGNL: Expression Injection leading to RCE - CVE-2025-20237
Cisco Secure Firewall Adaptive Security Appliance和Cisco Secu - CVE-2024-20329
Cisco Adaptive Security Appliance Software Remote Command In - CVE-2024-20470
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN
V. Comments for CVE-2023-20035
No comments yet