CVE-2023-20198:
Cisco IOS XE Software Web UI Feature Privilege Escalation Vulnerability (CVE-2023-20198)
Score
A numerical rating that indicates how dangerous this vulnerability is.
10.0Critical- Published Date:Oct 16, 2023
- CISA KEV Date:Oct 16, 2023
- Industries Affected:20
Threat Predictions
- EPSS Score:94.0
- EPSS Percentile:100%
Exploitability
- Score:3.9
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:NONE
- User Interaction:NONE
- Scope:CHANGED
Impact
- Score:6.0
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
Cisco IOS XE Software Web UI Feature Privilege Escalation Vulnerability (CVE-2023-20198)
Overview
CVE-2023-20198 is a critical vulnerability in Cisco IOS XE Software's web UI feature that allows attackers to gain initial access to affected systems. When exploited, the vulnerability enables attackers to issue privilege level 15 commands to create local user accounts with administrative access. This vulnerability was actively exploited in the wild as part of a two-stage attack. In the first stage, attackers exploited this vulnerability to create local user credentials. In the second stage, they leveraged another vulnerability (CVE-2023-20273) to elevate privileges to root and write malicious implants to the file system. Both vulnerabilities are tracked by Cisco bug ID CSCwh87343.
Remediation
- 1. Update to a fixed version of Cisco IOS XE Software as specified in the Cisco Security Advisory (cisco-sa-iosxe-webui-privesc-j22SaA4z).
- 2. If immediate patching is not possible, disable the web UI feature on all internet-facing devices.
- 3. Implement network segmentation to limit exposure of management interfaces.
- 4. Review system logs for signs of compromise, particularly looking for unexpected user account creation events.
- 5. Implement strict access control lists to restrict access to management interfaces.
- 6. Use the Cisco Software Checker tool to identify vulnerable software versions and available updates.
- 7. Monitor systems for unusual activity that might indicate compromise.
References
- 1. Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
- 2. Cisco Bug ID: CSCwh87343
- 3. Related vulnerability: CVE-2023-20273 (CVSS Score 7.2) - Used in conjunction with CVE-2023-20198
- 4. CVSS Score for CVE-2023-20198: 10.0 (Critical)
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
