---
title: "CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability"
url: https://erroneo.us/security/cve/CVE-2023-20198/
description: "CVE-2023-20198 (Cisco IOS XE Web UI): Exploited in the wild (CISA KEV). Cisco is providing an update for the ongoing investigation into observed…"
type: vulnerability-record
section: "Security Digest"
date_published: 2023-10-16
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2023-20198"
kev: true
cvss: 10
epss: 0.99609
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Cisco IOS XE Web UI. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2023-10-16, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2023-10-20 ; treat that as the outer limit, not the target.
- EPSS 99.6% , percentile 99.9: FIRST’s model estimates a 99.6% chance of exploitation activity in the next 30 days, higher than 99.9% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Act now. Cisco IOS XE Web UI Zero-Day Chain Implants Devices — If any IOS XE device has its HTTP or HTTPS server reachable from an untrusted network and is not on a fixed release, treat it as compromised until proven otherwise; devices with the web UI disabled were never exposed.

## What it is

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

## Affected products (CVE record)

- Cisco Cisco IOS XE Software: 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4, 16.3.5, 16.3.5b

## Severity

- cisco CVSS 3.1: 10 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2023-10-16; federal due date 2023-10-20. Known ransomware use: Unknown.
- CISA required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
- CISA SSVC assessment: exploitation active , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 99.61% probability of exploitation activity in the next 30 days; percentile 99.9.

## Sources

- [Listed in CISA KEV notes (cisco.com)](https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html)
- [CVE.org record CVE-2023-20198](https://www.cve.org/CVERecord?id=CVE-2023-20198)
- [NVD entry CVE-2023-20198](https://nvd.nist.gov/vuln/detail/CVE-2023-20198)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198)
- [cisco-sa-iosxe-webui-privesc-j22SaA4z](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z)

---
Source page: https://erroneo.us/security/cve/CVE-2023-20198/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt