Threat Brief: Cisco IOS XE Web UI Privilege Escalation Vulnerability (Updated)
Summary: Cisco published an advisory on Oct. 16, 2023 for CVE-2023-20198, an actively exploited privilege escalation zero-day in the IOS XE web user interface, rated 10 by the National Vulnerability Database, that lets an attacker create an account with level 15 full administrative access. Cortex Xpanse telemetry counted 22,074 implanted IOS XE devices on Oct. 18, 2023, falling to 18,359 by Oct. 19, with a non-persistent Lua-based implant that requires a web server restart to become active.
Why it matters: A maximum-severity flaw that grants level 15 access was already implanted on more than 22,000 internet-facing devices within two days of disclosure, and Cisco's primary workaround is to disable the HTTP Server feature on every internet-facing system.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-20198
- Related
- CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Oct 16, 2023