More helpful resources for users of all skill levels to help you Take a Security Action
Summary: Cisco Talos reported active exploitation of a previously unknown zero-day vulnerability, CVE-2023-20198, in the Web User Interface feature of Cisco IOS XE software when exposed to the internet or untrusted networks, allowing an attacker to create an account with privilege level 15 access and full control of the device. Researchers confirmed threat actors installed implants on targeted devices, with estimates that up to 10,000 devices could already be affected, and Cisco recommends disabling the HTTP server feature on internet-facing systems.
What's compelling: An attacker who creates a privilege level 15 account owns the device outright, and with up to 10,000 devices potentially already carrying implants, the exposure is measured in installed footholds rather than attempted intrusions.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2023-20198
- Related
- Grey Noise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks Cyber Risks ·CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Oct 16, 2023