CVE-2023-20198
Cisco IOS XE Web UI — Cisco IOS XE Web UI Privilege Escalation Vulnerability
Description
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2023-20198 carries a CVSS v3 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and sits at the 100th EPSS percentile, meaning virtually every exploitation model rates it as near-certain to be targeted. The vulnerability requires no credentials and no user interaction, and in observed attack chains it was chained immediately with CVE-2023-20273 to achieve root-level persistence via a filesystem implant — meaning a single unauthenticated HTTP request can result in full device takeover. The affected asset class — IOS XE routers, switches, and SD-WAN gateways — sits at the core of network infrastructure in exactly the sectors NIS2 designates as essential: energy, water, healthcare, and transport. Any organisation with IOS XE devices running the Web UI and reachable from untrusted networks should treat this as a Severity-1 incident; the CISA KEV listing and the 10.0 CVSS score together mandate immediate remediation under NIS2 Article 21 security-measure obligations.
Runbook · Step 1
Immediate response (0-24 h)
- Disable the Web UI immediately on all Cisco IOS XE devices where it is not strictly required:
no ip http serverandno ip http secure-serverin global configuration — this is the only reliable compensating control until a patch is applied. - Apply the vendor patch per Cisco Security Advisory CSCwh87343: fixed releases include 16.12.10a, 17.3.8a, 17.6.6a, and 17.9.4a — verify your specific train using the Cisco Software Checker at tools.cisco.com/security/center/softwarechecker.x; for Rockwell Allen-Bradley Stratix 5200/5800 (firmware 17.12.02), consult the Rockwell vendor advisory directly.
- Check for existing compromise: On every affected device, enumerate local accounts with
show running-config | include usernameand immediately remove any account not in your authorised baseline (no username <name>). - Implant detection: Issue
curl -k "https://<device-ip>/webui/logoutconfirm.html?logon_hash=1"— a non-empty HTTP response body is a strong indicator of the known filesystem implant (tracked as BADCANDY); isolate the device immediately if positive. - Restrict management access: Enforce ACLs so that TCP 80 and 443 to IOS XE management interfaces are reachable only from dedicated out-of-band management hosts — apply both on the perimeter firewall and via
ip http access-classon the device itself. - Rotate all credentials: Treat Enable Secret, local user passwords, and TACACS+/RADIUS shared secrets on any reachable device as potentially compromised and rotate them immediately.
Runbook · Step 2
Mitigation layers
- Perimeter and device ACLs: Block TCP 80/443 to IOS XE management interfaces from the internet and from untrusted internal segments at both the firewall and the device level — this eliminates the attack surface without requiring a maintenance window.
- IPS/NGFW signatures: Deploy Cisco Talos Snort SIDs for CVE-2023-20198 (published at snort.org/advisories) on inline IPS sensors in front of management segments; Suricata rules targeting anomalous URI paths (
/webui/,/logoutconfirm.html) against management IPs are an effective supplement. - AAA enforcement: Mandate TACACS+ or RADIUS as the sole authentication method; configure
login authenticationandaaa authentication loginso that locally created accounts cannot authenticate without a corresponding central directory entry. - Privilege-level auditing: Restrict Privilege Level 15 to explicitly named, centrally managed accounts; automate periodic audits of
privilege exec levelassignments via your NMS or Ansible playbooks. - Configuration change monitoring: Use Cisco Catalyst Center, RANCID, or Oxidized to capture running-config snapshots at least every 15 minutes and alert on any new
usernameentries or changes toip httpsettings.
Runbook · Step 3
Detection rules
- Syslog correlation: Alert on
%SYS-5-CONFIG_Ievents co-occurring within 60 seconds with%SEC_LOGIN-5-LOGIN_SUCCESSfor usernames not in the authorised baseline — KQL sketch:Syslog | where SyslogMessage contains "CONFIG_I" and SyslogMessage contains "username". - Network telemetry (Zeek/Suricata): Flag HTTP requests to management IPs with URI paths matching
/webui/,/+CSCOE+/, or/logoutconfirm.htmloriginating from non-management source IPs — Suricatahttp.uricontent match combined with destination IP in the management range. - Implant C2 traffic: Monitor Zeek
conn.logfor outbound HTTP/HTTPS connections whereid.orig_his a network device management IP — network devices initiating outbound web connections is anomalous and warrants immediate investigation. - Local account drift: Script a scheduled check (
show running-config | section username) via SSH from your NMS every 15–60 minutes; diff against the known-good baseline and treat any new entry as a critical alert requiring immediate human review. - AAA fallback logins: In your TACACS+/RADIUS server logs, alert on successful authentications for accounts that do not exist in the central directory — these indicate locally created backdoor accounts being used.
Metrics
Weakness classes (CWE)
CWE-420Base
Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
cwe.mitre.org →
Affected operating systems
mobile
cisco / ios_xe
other
rockwellautomation / allen-bradley_stratix_5200_firmware
other
rockwellautomation / allen-bradley_stratix_5800_firmware
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.