https://pwn.watch/t/ios-xe Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 23 Oct 2023 00:00:00 GMT https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198 https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198 Mon, 23 Oct 2023 00:00:00 GMT critical <p>Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 17.9.4a, 17.6.6a, 17.3.8a, 16.12.10a (Catalyst 3650/3850 only)</p> <p><strong>Latest updates:</strong></p><ul><li>2023-10-23: CISA adds CVE-2023-20273 to the KEV catalog</li><li>2023-10-22: First fixed release, 17.9.4a, published (<a href="https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html">source</a>)</li><li>2023-10-20: Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root</li></ul> <p><strong>CVEs:</strong> CVE-2023-20198, CVE-2023-20273</p>