CVE-2023-20076

RCE in Cisco 829 Industrial Integrated Services Router Firmware ≤ 15.9\(3\)

RCE Command Injection

Published

12 February 2023

Modified

21 November 2024

Patch / advisory

View advisory

CVSS Score v3.1 7.2

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.015 74th percentile

Risk Priority 56 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-20076 is a high-severity Improper Handling of Parameters (CWE-233) vulnerability in Cisco 829 Industrial Integrated Services Router Firmware. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 26% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-24255

Vulnerability Data

A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in…

for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system.

CWE(s): CWE-233 CWE-78

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

attack.mitre.org →

T1003.003 NTDS Credential Access

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

attack.mitre.org →

T1003.004 LSA Secrets Credential Access

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.

attack.mitre.org →

T1003.006 DCSync Credential Access

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…

attack.mitre.org →

T1003.008 /etc/passwd and /etc/shadow Credential Access

Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.

attack.mitre.org →

T1007 System Service Discovery Discovery

Adversaries may try to gather information about registered local system services.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-20007Same vendor: Cisco

CVE-2022-20708Same vendor: Cisco

CVE-2025-20194Same product: Cisco Ios Xe

CVE-2025-20186Same product: Cisco Ios Xe

CVE-2025-20193Same product: Cisco Ios Xe

CVE-2023-20082Same product: Cisco Ios Xe

CVE-2023-20056Same product: Cisco Ios Xe

CVE-2023-20273Same product: Cisco Ios Xe

CVE-2024-20469Same vendor: Cisco

CVE-2026-24698Same vendor: Cisco

Affected Assets

cisco

ic3000 industrial compute gateway

≤ 1.4.2

cisco

iox

all versions

cisco

ios xe

17.10.0 · ≤ 17.6.5 · 17.9.0 — 17.9.2

cisco

cgr1240 firmware

≤ 1.16.0.1

cisco

cgr1000 firmware

≤ 1.16.0.1

cisco

ir510 wpan firmware

≤ 1.10.0.1

cisco

829 industrial integrated services router firmware

15.9\(3\)m, 15.9\(3\)m1, 15.9\(3\)m2, 15.9\(3\)m2a, 15.9\(3\)m3 · ≤ 15.9\(3\)

cisco

807 industrial integrated services router firmware

15.9\(3\)m, 15.9\(3\)m1, 15.9\(3\)m2, 15.9\(3\)m2a, 15.9\(3\)m3 · ≤ 15.9\(3\)

cisco

809 industrial integrated services router firmware

15.9\(3\)m, 15.9\(3\)m1, 15.9\(3\)m2, 15.9\(3\)m2a, 15.9\(3\)m3 · ≤ 15.9\(3\)

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

—

Detect

Catch it (NIST detect / respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.2.5
V1.2.8

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

blocks

PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.

PR.PS-02 partial match

blocks

Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match

removes

A.5.15 Access control partial match

removes

A.5.16 Identity management partial match

removes

A.5.17 Authentication information partial match

removes

A.5.18 Access rights partial match

removes

A.8.10 Information deletion partial match

removes