Description Preview
A critical vulnerability in the web UI feature of Cisco IOS XE Software allows an unauthenticated, remote attacker to create local user accounts with privilege level 15 access. This vulnerability (CVE-2023-20198) was exploited in conjunction with another vulnerability (CVE-2023-20273) to gain root access and install malicious implants on affected systems. The vulnerability has been assigned a CVSS score of 10.0, indicating the highest severity level.
Overview
CVE-2023-20198 is a critical vulnerability in Cisco IOS XE Software's web UI feature that allows attackers to gain initial access to affected systems. When exploited, the vulnerability enables attackers to issue privilege level 15 commands to create local user accounts with administrative access. This vulnerability was actively exploited in the wild as part of a two-stage attack. In the first stage, attackers exploited this vulnerability to create local user credentials. In the second stage, they leveraged another vulnerability (CVE-2023-20273) to elevate privileges to root and write malicious implants to the file system. Both vulnerabilities are tracked by Cisco bug ID CSCwh87343.
Remediation
- Update to a fixed version of Cisco IOS XE Software as specified in the Cisco Security Advisory (cisco-sa-iosxe-webui-privesc-j22SaA4z).
- If immediate patching is not possible, disable the web UI feature on all internet-facing devices.
- Implement network segmentation to limit exposure of management interfaces.
- Review system logs for signs of compromise, particularly looking for unexpected user account creation events.
- Implement strict access control lists to restrict access to management interfaces.
- Use the Cisco Software Checker tool to identify vulnerable software versions and available updates.
- Monitor systems for unusual activity that might indicate compromise.
References
- Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
- Cisco Bug ID: CSCwh87343
- Related vulnerability: CVE-2023-20273 (CVSS Score 7.2) - Used in conjunction with CVE-2023-20198
- CVSS Score for CVE-2023-20198: 10.0 (Critical)
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing
- Health Care & Social AssistanceHealth Care & Social Assistance
- Public AdministrationPublic Administration
- Finance and InsuranceFinance and Insurance
- Retail TradeRetail Trade
- Other Services (except Public Administration)Other Services (except Public Administration)
- Transportation & WarehousingTransportation & Warehousing
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- UtilitiesUtilities
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- Educational ServicesEducational Services
- InformationInformation
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- ConstructionConstruction
- MiningMining
- Wholesale TradeWholesale Trade
