Cisco IOS XE Web UI (CVE-2023-20198)
CVE-2023-20198CWE-420OWASP A05:2021CVSS 10.0Updated August 29, 20261 min read
CVE-2023-20198 is a vulnerability in the Cisco IOS XE web management interface that let anyone who could reach it create an account at the highest privilege level. It scores 10.0. Within days tens of thousands of devices carried an implant. The real cause was not only the bug but that a management interface was facing the internet at all.
- Affected
- Cisco IOS XE with the HTTP or HTTPS server feature enabled and reachable from an untrusted network
- Patched in
- The fixed releases from the Cisco advisory; as an interim step, disable the HTTP and HTTPS server
- Actively exploited
- yes
In October 2023 it turned out that attackers were creating accounts on Cisco routers and switches at scale. They did not have to guess a password or chain a vulnerability. The management interface did it for them.
What is CVE-2023-20198
IOS XE has a web interface for administration. By constructing a request in a particular way, an unauthenticated visitor could create a local account at the highest privilege level. From that point on they were an administrator of the device.
In practice that account was used immediately to install an implant, giving the attacker a way to keep running commands even after the web interface restarted.
Why this is mostly a lesson about exposure
The bug was serious, but what created the scale was something else: tens of thousands of devices had their management interface on the open internet. A management interface belongs on a management network, not on the whole world. That is exactly what security misconfiguration describes.
Had the interface only been reachable internally, the same vulnerability would have been a problem for whoever was already inside, not for anyone with a connection.
What to do now
- Disable the HTTP and HTTPS server feature on devices that do not need it, and otherwise restrict it to a management network.
- Move the devices to the fixed releases from the Cisco advisory.
- Review the configuration for accounts nobody can account for, and remove them after investigating rather than before.
- Inventory which of your organisation’s management interfaces are reachable from the internet. Exposure like this is usually the first finding in a penetration test.
Sources
Frequently asked questions
What exactly is the flaw here?
The web interface accepted a request that did not pass the normal access control and created an account at the highest privilege level on the strength of it. No password was needed.
Why do you call this a misconfiguration?
The vulnerability was in the software, but the attack surface existed because a management interface was reachable from the internet. Cisco has advised against that for years.
How do I tell whether a device was hit?
Check for accounts you did not create and for unusual local users in the configuration. Cisco also published a request that reveals whether the implant is present.
Related articles
- CVEsCWE-77A03:2021PAN-OS GlobalProtect (CVE-2024-3400)CVE-2024-3400 explained: how a command injection in the PAN-OS GlobalProtect gateway handed attackers root on the firewall itself.
- VulnerabilitiesCWE-287A07:2021Broken authenticationBroken authentication explained: how attackers take over accounts through brute force, leaked passwords and predictable session tokens, and how to stop them.
- VulnerabilitiesCWE-94A03:2021Remote code execution (RCE)Remote code execution (RCE) explained: how attackers run their own commands or code on your server through unvalidated input, and how to prevent it.
- VulnerabilitiesCWE-16A05:2021Security misconfigurationSecurity misconfiguration explained: how default passwords, debug modes and open cloud buckets let attackers in, and how to harden your systems.