CVE-2023-20198
Cisco IOS XE Web UI Privilege Escalation Vulnerability
Cisco IOS XE Web UI
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
Exploitation status
CISA Known Exploited Vulnerabilities
Listed by CISA on 16 October 2023. US federal agencies were required to remediate it by 20 October 2023.
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 99.8%, which is higher than 99.9% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Frequently asked questions
Is CVE-2023-20198 being exploited by ransomware groups?
No ransomware group in this database is currently recorded as exploiting CVE-2023-20198.
What does CVE-2023-20198 affect?
CVE-2023-20198 affects Cisco IOS XE Web UI. Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
How severe is CVE-2023-20198?
CVE-2023-20198 is rated CRITICAL with a CVSS base score of 10. EPSS puts the probability of exploitation in the next 30 days at 99.8%, higher than 99.9% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 20 October 2023.
How should organisations respond to CVE-2023-20198?
Apply the vendor patch for Cisco IOS XE Web UI as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.