📌 이 취약점에 대해 확인된 사실
전부 발행처가 발표한 값입니다. 우리가 계산하거나 판단한 숫자는 하나도 없습니다.
악용 여부
악용 확인
2023-10-23
2023-10-27
CISA 미확인
심각도 (발행처 발표값)
높음7.2
3.1
NVD (미국 NIST)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
악용 확률 (EPSS)
92.9%
92.94%
99.8%
2026-11-03
📄 원문 그대로
아래 문장은 전부 발행처가 쓴 것입니다. 번역하지 않습니다 — 보안 문서의 오역은 조치를 바꿉니다.
취약점 설명 (NVD)
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
CISA 원문
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.— CISA KEV · shortDescription 원문
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.— CISA KEV · requiredAction 원문
악용 확률 변화
우리가 매일 저장한 EPSS 스냅샷입니다. 원본은 전날 값만 주므로, 이 표는 수집을 시작한 이후만 보여줍니다.
| 기준일 | 확률 | 백분위 |
|---|---|---|
| 2026-11-03 | 92.94% | 99.8% |
| 2026-11-02 | 92.94% | 99.8% |
| 2026-11-01 | 92.94% | 99.8% |
| 2026-10-31 | 92.94% | 99.8% |
| 2026-10-30 | 92.94% | 99.8% |
| 2026-10-29 | 92.94% | 99.8% |
| 2026-10-28 | 92.94% | 99.8% |
| 2026-10-27 | 92.94% | 99.8% |
| 2026-10-26 | 92.94% | 99.8% |
| 2026-10-25 | 92.94% | 99.8% |
| 2026-10-24 | 92.94% | 99.8% |
| 2026-10-23 | 92.99% | 99.8% |
| 2026-10-22 | 92.99% | 99.8% |
| 2026-10-21 | 92.99% | 99.8% |
● 실제 악용이 확인됨CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL…0.8%높음8.6● 실제 악용이 확인됨CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal Vulnerability2.2%심각9.8● 실제 악용이 확인됨CVE-2026-76504Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability38.9%심각9.8● 실제 악용이 확인됨CVE-2026-76460Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability75.6%심각10.0
🧩 같은 약점 유형 — CWE-78
같은 분류의 다른 취약점입니다. 같은 실수가 제품을 가리지 않고 반복됩니다.
● 실제 악용이 확인됨CVE-2014-6271GNU Bash through 4.3 processes trailing strings after function definitions in the values of env…100.0%심각9.8● 실제 악용이 확인됨CVE-2021-1498Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allo…100.0%심각9.8● 실제 악용이 확인됨CVE-2019-16920Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR…100.0%심각9.8● 실제 악용이 확인됨CVE-2022-44877login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows r…100.0%심각9.8
이 페이지는 조치 지시가 아닙니다. 영향 범위와 패치 버전은 제품·구성에 따라 다르므로, 반드시 공급사 공식 권고와 NVD 원문의 참조 링크를 확인하세요.