Security Digest · Vulnerability record · Known exploited
CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability
Exploited in the wild (CISA KEV). Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.
CISA KEV · added 2023-10-16 CVSS 10.0 Critical EPSS 99.6% · p99.9 Act now
Should you act?
Exploited: patch now if you run it
CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Yes, if you run Cisco IOS XE Web UI. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2023-10-16, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2023-10-20; treat that as the outer limit, not the target.
- EPSS 99.6%, percentile 99.9: FIRST’s model estimates a 99.6% chance of exploitation activity in the next 30 days, higher than 99.9% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Act now. Cisco IOS XE Web UI Zero-Day Chain Implants Devices — If any IOS XE device has its HTTP or HTTPS server reachable from an untrusted network and is not on a fixed release, treat it as compromised until proven otherwise; devices with the web UI disabled were never exposed.
What it is
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
CISA’s summary
Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.
Weakness type: CWE-420.
Product: Cisco IOS XE Web UI · Assigned by: cisco · Published: 2023-10-16
Affected and fixed versions
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| Cisco | Cisco IOS XE Software | 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4, 16.3.5, 16.3.5b |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| cisco | 3.1 | 10 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: none
- Scope: changed (can affect other components)
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: added 2023-10-16; federal due date 2023-10-20. Known ransomware use: Unknown.
- CISA required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
- CISA SSVC assessment: exploitation active, automatable yes, technical impact total.
- FIRST EPSS (model of 2026-10-21): 99.61% probability of exploitation activity in the next 30 days; percentile 99.9.
Timeline
- — Added to CISA’s Known Exploited Vulnerabilities catalog
- — CVE record published by cisco
- — erroneo.us brief: Cisco IOS XE Web UI Zero-Day Chain Implants Devices
- — CISA remediation deadline for US federal agencies
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vendor and project advisories, patches
- Listed in CISA KEV notes (cisco.com) cisco.com
Vulnerability records
- CVE.org record CVE-2023-20198 cve.org
- NVD entry CVE-2023-20198 nvd.nist.gov
Government
Other references from the CVE record and advisory
- cisco-sa-iosxe-webui-privesc-j22SaA4z sec.cloudapps.cisco.com
All exploited Cisco vulnerabilities · Today’s Security Digest