Unpacking CVE-2023-20198: A Critical Weakness In Cisco IOS XE:

Summary: On October 16th, 2023, Cisco disclosed CVE-2023-20198, a Web UI privilege escalation vulnerability with a CVSS base score of 10 that lets an unauthenticated attacker create an account with privilege level 15 access, and Cisco says it has been exploited in the wild with no patch available at the time of writing. Cisco Talos later added CVE-2023-20273, exploited to deploy an implant through a mechanism that remains undetermined and for which no patch exists, while VulnCheck and Censys scans found thousands of implanted internet-facing IOS XE hosts and over 40K exposed web admin interfaces.
Key Takeaway: Over 120 devices have already been put into malicious service across diverse autonomous systems, and the implant does not survive a reboot, so attackers can reinfect static-IP business-class devices at will unless they first created a persistent account.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-12650 CVE-2019-1862 CVE-2021-1435 CVE-2023-20198 CVE-2023-20273
Related: Grey Noise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks Cyber Risks ·
CVE-2023-20273: Cisco IOS XE Web UI Command Injection Vulnerability Known Exploited Vulnerabilities · Oct 23, 2023
CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Oct 16, 2023