Oct 22, 2023

Updated

• ClosedCritical✓Patched

  Cisco IOS XE web UI zero-days: implants on tens of thousands of devices

  Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.

  Cisco IOS XE Software (web UI)·Closed Oct 23, 2023·updated Oct 23, 2023