Cisco reveals exploit code is publicly available for critical switch vulnerabilities

Cisco Logo, hanging from the ceiling at a conference and shot through a telephoto lens
(Image credit: Getty Images)

Cisco has released patches for nine vulnerabilities impacting its small business network switches and said that exploit code has been spotted in the wild.

The vulnerabilities have been found in the user interface (UI) of Cisco Small Business Series switches and could be exploited by attackers to execute arbitrary code on a victim’s switch, or cause a denial of service (DoS) on a business’ network.

Four of the nine vulnerabilities were rated ‘critical’ on the CVSSv3 severity scale, each receiving a near-maximum score of 9.8.

The remaining flaws received scores between 7.5 and 8.6.

The critical flaws - tracked as CVE-2023-20159, CVE-2023-20160, CVE-2023-20161, and CVE-2023-20189 - stem from improper validation of requests sent through the web-based UI for the switches, which could allow an attacker to run malicious code via custom requests.

Five high-risk flaws also stem from the same UI issue and allow for individual devices to become subject to a DoS.

It’s recommended that affected organizations install the fixes as quickly as possible given the potential security risk and that exploit code exists online. There are no known workarounds that can mitigate the vulnerabilities.

Cisco did not indicate whether successful attacks have already taken place.


Whitepaper cover with title over solid purple circle graphics

(Image credit: Trend Micro)

Quantifying the public vulnerability market: 2022 edition

An analysis of vulnerability disclosures, impact severity, and product analysis


A number of Cisco’s Smart Switches, Series Managed Switches, and Series Stackable Switches are affected by the flaws with a full list available on the company’s official advisory.

Its 220 and Business 220 Series Smart Switches were found to be unaffected.

Cisco said it will not be releasing updates for the Small Business 200 Series Smart Switches, Small Business 300 Series Managed Switches, or Small Business 500 Series Stackable Managed Switches as all of these products have gone end of life (EOL) and are no longer supported by updates.

EOL notices for the relevant products were published in 2018 and 2019, with businesses having had the years since to move away from the soon-to-be-obsolete switches.

Given the prevalence of Cisco’s hardware in organizations’ networks worldwide, critical vulnerabilities of this kind should be taken seriously and patched as soon as possible.

Cisco small business switches have faced security challenges in the past, with three major vulnerabilities having been found in 2019, a year that also saw the networking and enterprise cyber security firm wrangle with a flaw known as Thrangycat.

Coupled with another flaw, Thrangycat could be used to bypass Cisco’s TAm security controls and remotely seize control of a router or potentially compromise an entire network.

Rory Bathgate

Rory Bathgate is a staff writer at ITPro covering the latest news on UK networking and data protection, privacy and compliance. He can sometimes be found on the ITPro Podcast, swapping a keyboard for a microphone to discuss the latest in tech trends.

In his free time, Rory enjoys photography, video editing and graphic design alongside good science fiction. After graduating from the University of Kent with BA in English and American Literature, Rory took an MA in Eighteenth-Century Studies at King’s College London. He joined ITPro in 2022 as a graduate, after four years in student journalism. You can contact Rory at or on LinkedIn.