CVE-2023-20198

10.0

CRITICAL CVSS 3.1

Cisco IOS XE Web UI Privilege Escalation Vulnerability - [Actively Exploited]

Description

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

INFO

Published Date :

Oct. 16, 2023, 4:15 p.m.

Last Modified :

May 15, 2025, 6:37 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Oct 20, 2023

Alert Date: Oct 16, 2023 | 686 days ago

Description :

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

Required Action :

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

Notes :

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html; https://nvd.nist.gov/vuln/detail/CVE-2023-20198

Affected Products

The following products are affected by CVE-2023-20198 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Rockwellautomation	allen-bradley_stratix_5200_firmware
2	Rockwellautomation	allen-bradley_stratix_5200
3	Rockwellautomation	allen-bradley_stratix_5800_firmware
4	Rockwellautomation	allen-bradley_stratix_5800
1	Cisco	ios_xe

: Total Affected Vendor : 2 | Products : 5

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]
	CVSS 3.1	CRITICAL				[email protected]

Solution

This vulnerability can be remediated by applying the vendor-provided updates.

Refer to the vendor advisory for specific patching and configuration guidance.
Apply the appropriate updates or patches provided by the vendor.

Public PoC/Exploit Available at Github

CVE-2023-20198 has a 80 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2023-20198.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z	Mitigation Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z	Mitigation Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-20198 is associated with the following CWEs:

CWE-420: Unprotected Alternate Channel

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-20198 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

zhanpengliu-tencent/medium-cve

None

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 15, 2025, 9:07 a.m. This repo has been linked 310 different CVEs too.

0day404/HV-2024-POC

护网2024-POC收录备份

Updated: 3 weeks, 4 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 4, 2025, 1:25 p.m. This repo has been linked 119 different CVEs too.

Lern0n/Lernon-POC

备份的漏洞库，3月开始我们来维护

Updated: 1 month, 2 weeks ago

2 stars 0 fork 0 watcher

Born at : June 30, 2025, 9:14 a.m. This repo has been linked 216 different CVEs too.

oLy0/Vulnerability

None

Updated: 2 months, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : June 15, 2025, 2:32 a.m. This repo has been linked 216 different CVEs too.

Arshit01/CVE-2023-20198

None

Python

Updated: 2 months, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : June 9, 2025, 10:13 a.m. This repo has been linked 1 different CVEs too.

zulloper/cve-poc

CVE POC repo 자동 수집기

Python

Updated: 19 hours, 54 minutes ago

0 stars 1 fork 1 watcher

Born at : June 8, 2025, 3:07 p.m. This repo has been linked 128 different CVEs too.

oLy0/Vulnerability

None

Updated: 3 months ago

0 stars 0 fork 0 watcher

Born at : May 30, 2025, 2:59 a.m. This repo has been linked 213 different CVEs too.

DOMINIC471/qub-network-security-cve-2023-20198

Analysis, detection, and mitigation of CVE-2023-20198 exploitation in Cisco IOS XE – QUB CSC3064 Network Security Assessment

Updated: 3 months, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : May 15, 2025, 8:25 p.m. This repo has been linked 1 different CVEs too.

ReaperGuardian/Flipper_Shits-

None

Python Shell HTML JavaScript PowerShell TeX

Updated: 3 months, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : May 13, 2025, 1:16 p.m. This repo has been linked 5 different CVEs too.

punyconspir/cisco-ios-xe-implant-scanner

A go-exploit to scan for implanted Cisco IOS XE Systems cve-2023-20198, go-exploit

Dockerfile Makefile Go

Updated: 3 months, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : May 8, 2025, 10:34 a.m. This repo has been linked 1 different CVEs too.

12442RF/POC

None

HTML

Updated: 3 months, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : May 6, 2025, 2:20 a.m. This repo has been linked 201 different CVEs too.

G4sul1n/Cisco-IOS-XE-CVE-2023-20198

Exploit PoC for CVE-2023-20198

Python

Updated: 3 months, 2 weeks ago

2 stars 0 fork 0 watcher

Born at : April 11, 2025, 3:37 p.m. This repo has been linked 2 different CVEs too.

laoa1573/wy876

wy876

Python

Updated: 1 month, 4 weeks ago

8 stars 2 fork 2 watcher

Born at : April 11, 2025, 4:25 a.m. This repo has been linked 209 different CVEs too.

adysec/POC

wy876 POC | wy876的poc仓库已删库，该项目为其仓库镜像

Updated: 1 month, 1 week ago

349 stars 196 fork 196 watcher

Born at : March 7, 2025, 10:17 a.m. This repo has been linked 201 different CVEs too.

cisp-pte/POC-20241008-sec-fork

收集整理漏洞EXP/POC,大部分漏洞来源网络，目前收集整理了1100多个poc/exp，长期更新。

Updated: 3 months, 2 weeks ago

1 stars 0 fork 0 watcher

Born at : March 7, 2025, 2:48 a.m. This repo has been linked 142 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-20198 vulnerability anywhere in the article.

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity – Week 35

The Good | Interpol Cracks Down on Cybercrime as U.S. Sanctions North Korean IT Scheme Interpol announced the arrest of over 1200 suspects in Operation Serengeti 2.0, a three-month crackdown on cyberc ...

Published Date: Aug 29, 2025 (3 days, 5 hours ago)

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity – Week 35

Published Date: Aug 29, 2025 (3 days, 5 hours ago)

The Hacker News

Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide

The China-linked advanced persistent threat (APT) actor known as Salt Typhoon has continued its attacks targeting networks across the world, including organizations in the telecommunications, governme ...

Published Date: Aug 28, 2025 (4 days, 6 hours ago)

Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto

UK and US Blame Three Chinese Tech Firms for Global Cyberattacks

A coalition of international cybersecurity agencies led by the UK’s National Cyber Security Centre (NCSC) has publicly linked three China-based technology companies to a long-running global cyberattac ...

Published Date: Aug 28, 2025 (4 days, 6 hours ago)

CybersecurityNews

CISA Publish Hunting and Mitigation Guide to Defend Networks from Chinese State-Sponsored Actors

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), alongside the NSA, FBI, and a broad coalition of international partners, has released a comprehensive cybersecurity advisory detailing ...

Published Date: Aug 28, 2025 (4 days, 10 hours ago)

The Register

If you thought China's Salt Typhoon was booted off critical networks, think again

China's Salt Typhoon cyberspies continue their years-long hacking campaign targeting critical industries around the world, according to a joint security alert from cyber and law enforcement agencies a ...

Published Date: Aug 28, 2025 (4 days, 12 hours ago)

Daily CyberSecurity

An Espionage System: NSA, CISA, & Partners Expose Chinese APT Groups

In a multinational alert, the U.S. National Security Agency (NSA), CISA, FBI, and partners from more than a dozen allied nations have released a Joint Cybersecurity Advisory (CSA) exposing how Chinese ...

Published Date: Aug 28, 2025 (4 days, 16 hours ago)

BleepingComputer

Global Salt Typhoon hacking campaigns linked to Chinese tech firms

The U.S. National Security Agency (NSA), the UK's National Cyber Security Centre (NCSC), and partners from over a dozen countries have linked the Salt Typhoon global hacking campaigns to three China-b ...

Published Date: Aug 27, 2025 (5 days, 2 hours ago)

BleepingComputer

Chinese hackers breached National Guard to steal network configurations

The Chinese state-sponsored hacking group known as Salt Typhoon breached and remained undetected in a U.S. Army National Guard network for nine months in 2024, stealing network configuration files and ...

Published Date: Jul 17, 2025 (1 month, 2 weeks ago)

Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto

Chinese Salt Typhoon Infiltrated US National Guard Network for Months

A sophisticated Chinese APT group, Salt Typhoon, successfully infiltrated the US state’s Army National Guard network for nearly a year, from March 2024 to December 2024. This breach, detailed in a Dep ...

Published Date: Jul 17, 2025 (1 month, 2 weeks ago)

The Hacker News

Chinese Hackers Target Taiwan's Semiconductor Sector with Cobalt Strike, Custom Backdoors

The Taiwanese semiconductor industry has become the target of spear-phishing campaigns undertaken by three Chinese state-sponsored threat actors. "Targets of these campaigns ranged from organizations ...

Published Date: Jul 17, 2025 (1 month, 2 weeks ago)

Dark Reading

Oh! Canada Added to List of Nations Targeted in Salt Typhoon Telecom Spree

Source: Mattia Dantonio via Alamy Stock PhotoCanada has confirmed that Salt Typhoon targeted one of its telecommunications companies in February via a Cisco flaw, adding it to the growing list of org ...

Published Date: Jun 24, 2025 (2 months, 1 week ago)

The Hacker News

China-linked Salt Typhoon Exploits Critical Cisco Vulnerability to Target Canadian Telecom

Cyber Espionage / Chinese Hackers The Canadian Centre for Cyber Security and the U.S. Federal Bureau of Investigation (FBI) have issued an advisory warning of cyber attacks mounted by the China-linked ...

Published Date: Jun 24, 2025 (2 months, 1 week ago)

Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto

Salt Typhoon Targets Telecoms via Router Flaws, Warn FBI and Canada

A newly released advisory from the FBI and Canada’s Cyber Centre warns of an ongoing cyber espionage campaign by a China-linked group that is targeting telecom networks worldwide. The report, issued J ...