cisco-sa-webui-dos-qdc7qx3MediumCVSS 4.3

Cisco IOS XE Software Web-Based Management Interface Denial of Service Vulnerability

Published
August 5, 2026
Last Modified
August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-20308 →

📋 Description

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an affected device.

This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the web-based management interface to become unresponsive.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CVE-2026-20308 — Cisco IOS XE Software Web-Based Management Interface Vulnerability (CVSS 3.1 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

🎯 Affected products247

  • Cisco Aironet Access Point Software (IOS XE Controller)
  • Cisco IOS XE Catalyst SD-WAN
  • Cisco IOS XE Software
  • Cisco IOS XE Software Bootloader (ROMMON)
  • Cisco IOS XG Software
  • Cisco IOS XR Software
  • Cisco IOS XE Software 16.10.1
  • Cisco IOS XE Software 16.10.1a
  • Cisco IOS XE Software 16.10.1b
  • Cisco IOS XE Software 16.10.1c
  • Cisco IOS XE Software 16.10.1d
  • Cisco IOS XE Software 16.10.1e
  • Cisco IOS XE Software 16.10.1f
  • Cisco IOS XE Software 16.10.1g
  • Cisco IOS XE Software 16.10.1s
  • Cisco IOS XE Software 16.10.2
  • Cisco IOS XE Software 16.10.3
  • Cisco IOS XE Software 16.11.1
  • Cisco IOS XE Software 16.11.1a
  • Cisco IOS XE Software 16.11.1b
  • Cisco IOS XE Software 16.11.1c
  • Cisco IOS XE Software 16.11.1s
  • Cisco IOS XE Software 16.11.2
  • Cisco IOS XE Software 16.12.1
  • Cisco IOS XE Software 16.12.10
  • Cisco IOS XE Software 16.12.10a
  • Cisco IOS XE Software 16.12.11
  • Cisco IOS XE Software 16.12.12
  • Cisco IOS XE Software 16.12.13
  • Cisco IOS XE Software 16.12.14
  • +217 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability. However, there is a mitigation. Disabling the HTTP Server feature eliminates the attack vector for these vulnerabilities and may be a suitable mitigation until affected devices can be upgraded. To disable the HTTP Server feature, use the no ip http server or no ip http secure-server command in global configuration mode. If both the HTTP server and HTTPS server are in use, both commands are required to disable the HTTP Server feature. Allowing only trusted networks to access the HTTP server will limit exposure to these vulnerabilities. The following example shows how to allow remote access to the HTTP server from the trusted 192.168.10.0/24 network: ! ip http access-class ipv4 restrict_ipv4_webui ! ip access-list standard restrict_ipv4_webui permit 192.168.10.0 0.0.0.255 ! For additional information, see Filter Traffic Destined to Cisco IOS XE Devices WebUI Using an Access List ["https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-17/221107-filter-traffic-destined-to-cisco-ios-xe.html"]. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

🔗 References (3)