Cisco IOS XE web UI zero-days: implants on tens of thousands of devices

Cisco IOS XE Software (web UI)

Follow this incident

RSS
JSON
llms.txt

Updated Oct 23, 2023

Updates on Oct 20, 2023

Oct 20, 2023
Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root

Summary

Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.

Read the full incident →

Advisories5

Multiple Vulnerabilities in Cisco IOS XE Software Web UI FeatureCisco · Oct 16, 2023
Guidance for Addressing Cisco IOS XE Web UI VulnerabilitiesCISA
NVD: CVE-2023-20198NVD
NVD: CVE-2023-20273NVD
CISA Known Exploited Vulnerabilities CatalogCISA · Oct 16, 2023

Get notified