Cisco IOS XE web UI zero-days: implants on tens of thousands of devices

Updates on Sep 18, 2023

Summary

Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.

Advisories5

• Multiple Vulnerabilities in Cisco IOS XE Software Web UI FeatureCisco · Oct 16, 2023
• Guidance for Addressing Cisco IOS XE Web UI VulnerabilitiesCISA
• NVD: CVE-2023-20198NVD
• NVD: CVE-2023-20273NVD
• CISA Known Exploited Vulnerabilities CatalogCISA · Oct 16, 2023