Cisco IOS XE Web UI Zero-Day Chain Implants Devices

What to do

1. Run `show running-config | include ip http` on every IOS XE device to find web UI exposure.
2. Where the web UI is not needed, apply `no ip http server` and `no ip http secure-server`, then `copy running-config startup-config`.
3. Where it is needed, restrict it to trusted management networks with an access list (`ip http access-class ipv4 ...`).
4. Upgrade to 17.9.4a, 17.6.6a, 17.3.8a or 16.12.10a (or a later release from Cisco's Software Checker).
5. Treat any device with unknown local accounts or implant indicators as compromised: remove accounts, rebuild from known-good config, and rotate credentials.

How to check if you are affected or compromised

• Review logs for %SYS-5-CONFIG_P and %SEC_LOGIN-5-WEBLOGIN_SUCCESS entries showing unknown users such as cisco_tac_admin or cisco_support.
• Look for %WEBUI-6-INSTALL_OPERATION_INFO entries with unexpected filenames.
• Run the Talos implant checks from a trusted host, e.g. `curl -k "https://DEVICEIP/%25"` and the authenticated logoutconfirm POST published by Cisco and Talos.
• Run `show running-config | include username` and compare against your account inventory.

What happened#

On October 16, 2023, Cisco disclosed active exploitation of a previously unknown flaw in the web UI of Cisco IOS XE Software, CVE-2023-20198 (CVSS 10.0). An unauthenticated remote attacker could use it to issue a privilege 15 command and create a local account. On October 20, Cisco and Talos added the second half of the chain: CVE-2023-20273 (CVSS 7.2), a command injection the attacker reached with the new account to run commands as root and write an implant to the file system.

Talos traced related activity to September 18, 2023, and a second cluster beginning October 12 that deployed a small Lua implant (later named BadCandy) under the device's web server configuration. The implant is not persistent across reboots, but the rogue local accounts are. Internet scans found tens of thousands of implanted devices within days: BleepingComputer reported counts of about 30,000 from LeakIX, more than 34,500 from CERT Orange, and 41,983 from Censys by October 18. Around October 20, attackers updated the implant to require an authorization header, so the original check stopped finding it and Talos published a new one on October 23.

CISA added CVE-2023-20198 to the KEV catalog on October 16, 2023 (due October 20) and CVE-2023-20273 on October 23; both remain listed as of this writing. Fixed releases began rolling out October 22.

Who is affected#

Any Cisco IOS XE device, including switches, routers and wireless controllers, with ip http server or ip http secure-server enabled and running a release without the fix. Cisco notes that configuring ip http active-session-modules none (or the HTTPS equivalent) blocks exploitation over that server. NVD and Cisco both score CVE-2023-20198 at 10.0; CVE-2023-20273 requires high privileges, which the first bug supplies. Fixed releases: 17.9.4a, 17.6.6a, 17.3.8a, and 16.12.10a for Catalyst 3650/3850.

Do you really need to act?#

This splits cleanly. If the web UI is disabled, you were never exposed and there is nothing to chase. If it was reachable from the internet before late October 2023, the odds of compromise were high, given the scan numbers. A reboot clears the original implant but not the attacker's local accounts, so "we rebooted" is not evidence of safety. Cisco says no workaround fully fixes the issue, and that disabling the HTTP server removes the attack vector. The web UI on network devices rarely needs to face the internet; CISA's guidance leads with disabling it on internet-facing systems.

What to do now#

1. Find exposure: show running-config | include ip http on every IOS XE device.
2. If the web UI is unneeded: no ip http server, no ip http secure-server, then copy running-config startup-config.
3. If it is needed, restrict it with ip http access-class ipv4 to management networks only.
4. Upgrade to a fixed release, using Cisco's Software Checker to confirm your train.
5. Remove unknown local users, rebuild suspicious devices from known-good configs, and rotate any credentials stored on them.

How to tell if you were hit#

Cisco lists log indicators: %SYS-5-CONFIG_P or %SEC_LOGIN-5-WEBLOGIN_SUCCESS showing unknown users such as cisco_tac_admin or cisco_support, and %WEBUI-6-INSTALL_OPERATION_INFO with unexpected filenames. Talos published curl checks for the implant, including curl -k "https://DEVICEIP/%25", where a 404 suggests an early implant variant and a login page suggests the third variant. Run them from a trusted host. An implant check only works if the web server was restarted after installation, so check accounts too.

Timeline#

• Sep 18, 2023 — Earliest related activity identified by Talos.
• Sep 28, 2023 — Cisco TAC case flags unusual behavior on a customer device.
• Oct 12, 2023 — Second activity cluster deploys the implant.
• Oct 16, 2023 — Cisco advisory; CISA adds CVE-2023-20198 to KEV.
• Oct 18, 2023 — Censys counts 41,983 compromised devices.
• Oct 20, 2023 — CVE-2023-20273 disclosed as second stage.
• Oct 22, 2023 — Fixed releases begin shipping.
• Oct 23, 2023 — CISA adds CVE-2023-20273 to KEV; Talos publishes updated implant check.
• Nov 1, 2023 — Cisco marks the advisory final; Talos reports exploitation rising after public proofs of concept.

Vulnerability records

• CVE-2023-20198 · KEV 2023-10-16 · Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.
• CVE-2023-20273 · KEV 2023-10-23 · A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Cisco — Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature (cisco-sa-iosxe-webui-privesc-j22SaA4z) sec.cloudapps.cisco.com
2. Cisco Talos — Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities blog.talosintelligence.com
3. NVD — CVE-2023-20198 nvd.nist.gov
4. NVD — CVE-2023-20273 nvd.nist.gov
5. CISA — Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities cisa.gov
6. CISA — Known Exploited Vulnerabilities Catalog cisa.gov

Coverage and analysis

1. BleepingComputer — Over 40,000 Cisco IOS XE devices infected with backdoor using zero-day bleepingcomputer.com