ClosedPatched
Day · Oct 22, 2023
Cisco IOS XE web UI zero-days: implants on tens of thousands of devices
Cisco IOS XE Software (web UI)
Updates on Oct 22, 2023
First fixed release, 17.9.4a, published
Source
Summary
Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.
Read the full incident →