Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities
Summary: Cisco Talos documented a threat actor creating local administrator accounts on Cisco IOS XE devices via CVE-2023-20198 (CVSS 10) and then exploiting CVE-2023-20273 (CVSS 7.2) to deploy a Lua-based web shell it named BadCandy, with activity traced from September 18, 2023 through a third implant variant found on November 2. The implant is non-persistent and removed by reboot, but the level 15 accounts it creates survive reboots, and exploitation attempts rose sharply after proof-of-concept code was published on October 30 and 31.
Key Takeaway: The accounts the actor created carry full administrator privileges and remain active after reboot, so a device that looks clean after restart can still be owned; Talos also assesses the September and October clusters were the same actor, who deleted the earlier 'cisco_tac_admin' account as cleanup.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-1435CVE-2023-20198CVE-2023-20273
- Related
- Grey Noise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks Cyber Risks ·CVE-2023-20273: Cisco IOS XE Web UI Command Injection Vulnerability Known Exploited Vulnerabilities · Oct 23, 2023