CVE-2023-20198:Cisco IOS XE Software Web UI Feature Privilege Escalation Vulnerability (CVE-2023-20198)

splash
Back

Description Preview

A critical vulnerability in the web UI feature of Cisco IOS XE Software allows an unauthenticated, remote attacker to create local user accounts with privilege level 15 access. This vulnerability (CVE-2023-20198) was exploited in conjunction with another vulnerability (CVE-2023-20273) to gain root access and install malicious implants on affected systems. The vulnerability has been assigned a CVSS score of 10.0, indicating the highest severity level.

Overview

CVE-2023-20198 is a critical vulnerability in Cisco IOS XE Software's web UI feature that allows attackers to gain initial access to affected systems. When exploited, the vulnerability enables attackers to issue privilege level 15 commands to create local user accounts with administrative access. This vulnerability was actively exploited in the wild as part of a two-stage attack. In the first stage, attackers exploited this vulnerability to create local user credentials. In the second stage, they leveraged another vulnerability (CVE-2023-20273) to elevate privileges to root and write malicious implants to the file system. Both vulnerabilities are tracked by Cisco bug ID CSCwh87343.

Remediation

  1. Update to a fixed version of Cisco IOS XE Software as specified in the Cisco Security Advisory (cisco-sa-iosxe-webui-privesc-j22SaA4z).
  2. If immediate patching is not possible, disable the web UI feature on all internet-facing devices.
  3. Implement network segmentation to limit exposure of management interfaces.
  4. Review system logs for signs of compromise, particularly looking for unexpected user account creation events.
  5. Implement strict access control lists to restrict access to management interfaces.
  6. Use the Cisco Software Checker tool to identify vulnerable software versions and available updates.
  7. Monitor systems for unusual activity that might indicate compromise.

References

  1. Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
  2. Cisco Bug ID: CSCwh87343
  3. Related vulnerability: CVE-2023-20273 (CVSS Score 7.2) - Used in conjunction with CVE-2023-20198
  4. CVSS Score for CVE-2023-20198: 10.0 (Critical)

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Public Administration: Medium
    Public Administration
  2. Manufacturing: Medium
    Manufacturing
  3. Health Care & Social Assistance: Medium
    Health Care & Social Assistance
  4. Finance and Insurance: Low
    Finance and Insurance
  5. Retail Trade: Low
    Retail Trade
  6. Educational Services: Low
    Educational Services
  7. Transportation & Warehousing: Low
    Transportation & Warehousing
  8. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  9. Utilities: Low
    Utilities
  10. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  11. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  12. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  13. Accommodation & Food Services: Low
    Accommodation & Food Services
  14. Information: Low
    Information
  15. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  16. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  17. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  18. Construction: Low
    Construction
  19. Mining: Low
    Mining
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background