Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

Cisco IOS XE version 16 < 16.12.10.a / 17.3 < 17.3.8.a / 17.6 < 17.6.6a / 17.9 < 17.9.4a are affected by a vulnerability that allows an unauthenticated remote attacker to execute arbitrary code and also to create an account on an affected system with privilege level 15 access. The attacker can then use this account to take control of the affected system.

The Cisco IOS XE web interface on the remote host is affected by a remote command execution vulnerability. A remote, unauthenticated attacker can exploit this, by sending a crafted request, to perform actions such as creating a new administrator user, or executing arbitrary commands at privilege level 15.

This vulnerability in the Web UI feature of Cisco IOS XE Software allows a remote, unauthenticated threat actor to create an account on a vulnerable system with privilege level 15 access. The threat actor could then potentially use that account to gain control of the affected system.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The Cisco IOS XE web interface on the remote host is likely compromised.

A vulnerability in the web UI feature of Cisco IOS XE Software, when exposed to the internet or to untrusted networks, could allow an unauthenticated, remote attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system. For steps to close the attack vector for this vulnerability, see the Recommendations section of the vendor's advisory. The vendor (Cisco) will provide updates on the status of this investigation and when a software patch is available.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114231	Cisco IOS XE Remote Code Execution	Web App Scanning	Component Vulnerability	critical
184452	Cisco IOS XE Unauthenticatd Remote Command Execution (CVE-2023-20198) (Direct Check)	Nessus	CISCO	critical
501759	Rockwell Automation Stratix 5800 & 5200 Cisco IOS XE Web UI Privilege Escalation (CVE-2023-20198)	Tenable OT Security	Tenable.ot	critical
183312	Cisco IOS XE CVE-2023-20198 Implant Indicator of Compromise	Nessus	CISCO	critical
183167	Cisco IOS XE Software Web UI Privilege Escalation (cisco-sa-iosxe-webui-privesc-j22SaA4z)	Nessus	CISCO	critical

Detections

Analytics

CVE-2023-20198

critical

Tenable Plugins

critical

critical

critical

critical

critical