---
id: CVE-2023-20097
title: Cisco Access Points (AP)  Command Injection Vulnerability
summary: "A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges.\r\n\r\nThis vulnerability is due to improper input validation of commands tha…"
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N'
cvssSource: vendor
vendor: Cisco
product: Cisco Aironet Access Point Software (IOS XE Controller)
affected:
  - aironet_access_point_software_ios_xe_controller
  - aironet_access_point_software
published: '2023-03-22'
updated: '2023-03-22'
sourceUpdated: '2023-03-22T16:00:00+00:00'
source: CSAF
sourceUrl: >-
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8
  - url: 'https://software.cisco.com'
tags:
  - csaf
  - vendor-advisory
  - cisco
epss: 0.00236
epssPercentile: 0.12948
ingestedAt: '2026-09-08T15:58:18.538Z'
---

## Overview

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges.

This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

## Vendor advisories

- **cisco-sa-aironetap-cmdinj-6bjT4FL8** · Cisco · affected: Cisco Aironet Access Point Software (IOS XE Controller), Cisco Aironet Access Point Software · updated 2023-03-22 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8)

**Cisco Access Point Software Command Injection Vulnerability**. Released 2023-03-22.

Affected:

- Cisco Aironet Access Point Software (IOS XE Controller)
- Cisco Aironet Access Point Software

## Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com