---
title: "Cisco IOS XE Web UI Zero-Day Chain Implants Devices"
url: https://erroneo.us/security/briefs/cisco-ios-xe-web-ui-cve-2023-20198/
description: "CVE-2023-20198 + CVE-2023-20273 gave root on IOS XE with the web UI exposed; tens of thousands implanted. Disable ip http server, patch to 17.9.4a+."
type: security-brief
section: "Security Digest"
date_published: 2023-10-16
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2023-20198", "CVE-2023-20273"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco IOS XE Web UI Zero-Day Chain Implants Devices

**Verdict: Act now.** If any IOS XE device has its HTTP or HTTPS server reachable from an untrusted network and is not on a fixed release, treat it as compromised until proven otherwise; devices with the web UI disabled were never exposed.

- **Who must act:** Operators of Cisco IOS XE switches, routers and wireless controllers with `ip http server` or `ip http secure-server` enabled, especially where the web UI faces the internet.
- **Who can relax:** Devices with the HTTP and HTTPS servers disabled, and Cisco ASA, FTD, ISE, IOS, NX-OS and IOS XE releases before 16, which Cisco confirmed are not affected.
- **Affected:** Cisco IOS XE Software with the web UI enabled (ip http server or ip http secure-server) on releases before the fixes below
- **Fixed:** 17.9.4a; 17.6.6a; 17.3.8a; 16.12.10a (Catalyst 3650 and 3850 only); SMUs for 17.9.4 and 17.6.5
- **CVEs:** CVE-2023-20198, CVE-2023-20273
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run `show running-config | include ip http` on every IOS XE device to find web UI exposure.
2. Where the web UI is not needed, apply `no ip http server` and `no ip http secure-server`, then `copy running-config startup-config`.
3. Where it is needed, restrict it to trusted management networks with an access list (`ip http access-class ipv4 ...`).
4. Upgrade to 17.9.4a, 17.6.6a, 17.3.8a or 16.12.10a (or a later release from Cisco's Software Checker).
5. Treat any device with unknown local accounts or implant indicators as compromised: remove accounts, rebuild from known-good config, and rotate credentials.

### How to check if you are affected

- Review logs for %SYS-5-CONFIG_P and %SEC_LOGIN-5-WEBLOGIN_SUCCESS entries showing unknown users such as cisco_tac_admin or cisco_support.
- Look for %WEBUI-6-INSTALL_OPERATION_INFO entries with unexpected filenames.
- Run the Talos implant checks from a trusted host, e.g. `curl -k "https://DEVICEIP/%25"` and the authenticated logoutconfirm POST published by Cisco and Talos.
- Run `show running-config | include username` and compare against your account inventory.

## What happened

On October 16, 2023, Cisco [disclosed](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z) active exploitation of a previously unknown flaw in the web UI of Cisco IOS XE Software, CVE-2023-20198 (CVSS 10.0). An unauthenticated remote attacker could use it to issue a privilege 15 command and create a local account. On October 20, Cisco and [Talos](https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/) added the second half of the chain: CVE-2023-20273 (CVSS 7.2), a command injection the attacker reached with the new account to run commands as root and write an implant to the file system.

Talos traced related activity to September 18, 2023, and a second cluster beginning October 12 that deployed a small Lua implant (later named BadCandy) under the device's web server configuration. The implant is not persistent across reboots, but the rogue local accounts are. Internet scans found tens of thousands of implanted devices within days: [BleepingComputer reported](https://www.bleepingcomputer.com/news/security/over-40-000-cisco-ios-xe-devices-infected-with-backdoor-using-zero-day/) counts of about 30,000 from LeakIX, more than 34,500 from CERT Orange, and 41,983 from Censys by October 18. Around October 20, attackers updated the implant to require an authorization header, so the original check stopped finding it and Talos published a new one on October 23.

CISA added CVE-2023-20198 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on October 16, 2023 (due October 20) and CVE-2023-20273 on October 23; both remain listed as of this writing. Fixed releases began rolling out October 22.

## Who is affected

Any Cisco IOS XE device, including switches, routers and wireless controllers, with `ip http server` or `ip http secure-server` enabled and running a release without the fix. Cisco notes that configuring `ip http active-session-modules none` (or the HTTPS equivalent) blocks exploitation over that server. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-20198) and Cisco both score CVE-2023-20198 at 10.0; [CVE-2023-20273](https://nvd.nist.gov/vuln/detail/CVE-2023-20273) requires high privileges, which the first bug supplies. Fixed releases: 17.9.4a, 17.6.6a, 17.3.8a, and 16.12.10a for Catalyst 3650/3850.

## Do you really need to act?

This splits cleanly. If the web UI is disabled, you were never exposed and there is nothing to chase. If it was reachable from the internet before late October 2023, the odds of compromise were high, given the scan numbers. A reboot clears the original implant but not the attacker's local accounts, so "we rebooted" is not evidence of safety. Cisco says no workaround fully fixes the issue, and that disabling the HTTP server removes the attack vector. The web UI on network devices rarely needs to face the internet; [CISA's guidance](https://www.cisa.gov/guidance-addressing-cisco-ios-xe-web-ui-vulnerabilities) leads with disabling it on internet-facing systems.

## What to do now

1. Find exposure: `show running-config | include ip http` on every IOS XE device.
2. If the web UI is unneeded: `no ip http server`, `no ip http secure-server`, then `copy running-config startup-config`.
3. If it is needed, restrict it with `ip http access-class ipv4` to management networks only.
4. Upgrade to a fixed release, using Cisco's Software Checker to confirm your train.
5. Remove unknown local users, rebuild suspicious devices from known-good configs, and rotate any credentials stored on them.

## How to tell if you were hit

Cisco lists log indicators: `%SYS-5-CONFIG_P` or `%SEC_LOGIN-5-WEBLOGIN_SUCCESS` showing unknown users such as `cisco_tac_admin` or `cisco_support`, and `%WEBUI-6-INSTALL_OPERATION_INFO` with unexpected filenames. Talos published curl checks for the implant, including `curl -k "https://DEVICEIP/%25"`, where a 404 suggests an early implant variant and a login page suggests the third variant. Run them from a trusted host. An implant check only works if the web server was restarted after installation, so check accounts too.

## Timeline

- Sep 18, 2023 — Earliest related activity identified by Talos.
- Sep 28, 2023 — Cisco TAC case flags unusual behavior on a customer device.
- Oct 12, 2023 — Second activity cluster deploys the implant.
- Oct 16, 2023 — Cisco advisory; CISA adds CVE-2023-20198 to KEV.
- Oct 18, 2023 — Censys counts 41,983 compromised devices.
- Oct 20, 2023 — CVE-2023-20273 disclosed as second stage.
- Oct 22, 2023 — Fixed releases begin shipping.
- Oct 23, 2023 — CISA adds CVE-2023-20273 to KEV; Talos publishes updated implant check.
- Nov 1, 2023 — Cisco marks the advisory final; Talos reports exploitation rising after public proofs of concept.

## Sources

1. [Cisco — Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature (cisco-sa-iosxe-webui-privesc-j22SaA4z)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z)
2. [Cisco Talos — Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities](https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/)
3. [NVD — CVE-2023-20198](https://nvd.nist.gov/vuln/detail/CVE-2023-20198)
4. [NVD — CVE-2023-20273](https://nvd.nist.gov/vuln/detail/CVE-2023-20273)
5. [CISA — Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities](https://www.cisa.gov/guidance-addressing-cisco-ios-xe-web-ui-vulnerabilities)
6. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
7. [BleepingComputer — Over 40,000 Cisco IOS XE devices infected with backdoor using zero-day](https://www.bleepingcomputer.com/news/security/over-40-000-cisco-ios-xe-devices-infected-with-backdoor-using-zero-day/)

---
Source page: https://erroneo.us/security/briefs/cisco-ios-xe-web-ui-cve-2023-20198/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt