Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-20036 is a critical-severity OS Command Injection (CWE-78) vulnerability in Cisco Industrial Network Director. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked in the top 4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in the web UI of Cisco Industrial Network Director (IND) stems from improper input validation during Device Pack uploads. An authenticated remote attacker can modify the associated HTTP request to inject operating system commands, resulting in arbitrary code execution as NT AUTHORITY\SYSTEM on the underlying Windows host. The flaw is tracked as CWE-78 and carries a CVSS 3.1 score of 9.9.
An attacker with valid credentials to the IND web interface can exploit the issue without user interaction by tampering with the upload workflow. Successful exploitation grants full administrative control over the affected device operating system, enabling persistence, lateral movement, or disruption of industrial network management functions.
Cisco has published software updates that remediate the vulnerability and states that no workarounds exist. The sole advisory reference is the vendor notice at sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V.
EPSS for the CVE reached a peak of 0.1235 on 2026-04-21 before receding to the current value of 0.0876; no public evidence of in-the-wild exploitation has been reported.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-24215
Vulnerability Data
A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. This vulnerability is due to improper input validation when…
more
uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITY\SYSTEM on the underlying operating system of an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5V1.2.8
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect command sanitization during development.
Input validation directly neutralizes or rejects special characters that would otherwise alter OS command structure.
Least privilege reduces the permissions available to any process that could be subverted by injected commands.
Least functionality restricts available OS commands and interpreters, limiting the blast radius of injection.
Secure engineering principles require proper neutralization of untrusted input before command construction.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.