Cisco IOS XE web UI zero-days: implants on tens of thousands of devices
Cisco IOS XE Software (web UI)
Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.
Why this severity: CVSS 10.0 (CVE-2023-20198), zero-day, actively exploited (CISA KEV)
- Started
- Sep 18, 2023
- Closed
- Oct 23, 2023
Affected
- IOS XE with the HTTP/HTTPS server (web UI) enabled; see vendor advisory
Fixed in
- 17.9.4a
- 17.6.6a
- 17.3.8a
- 16.12.10a (Catalyst 3650/3850 only)
Updates by day5
▸Oct 23, 2023
Link #CISA adds CVE-2023-20273 to the KEV catalog
▸Oct 22, 2023
Link #First fixed release, 17.9.4a, published
Source
▸Oct 20, 2023
Link #Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root
▸Oct 16, 2023
Link #Cisco advisory and Talos write-up on active exploitation; CISA adds CVE-2023-20198 to KEV
Source
▸Sep 18, 2023
Link #Earliest malicious activity found by Cisco Talos
Source
Advisories5
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
