Loading HuntDB...

CVE-2023-20198

CRITICAL
Published 2023-10-16T15:12:58.735Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-20198. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
10.0
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.942
probability
of exploitation in the wild

There is a 94.2% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.999
Higher than 99.9% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Description

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

Available Exploits

No exploits available for this CVE.

Related News

CVE-2023-20198 & CVE-2023-20273: RedMike Attacks 1,000+ Cisco Devices in Global Espionage Campaign

Cybersecurity researchers at Insikt Group have identified an ongoing cyber espionage campaign by RedMike (also tracked as Salt The post CVE-2023-20198 & CVE-2023-20273: RedMike Attacks 1,000+ Cisco Devices in Global Espionage Campaign appeared first on Cybersecurity News.

SecurityOnline.info 2025-02-18 02:06

Affected Products

Known Exploited Vulnerability

This vulnerability is actively being exploited in the wild

View KEV Details

Remediation Status

Overdue

Due Date

October 20, 2023

Added to KEV

October 16, 2023

Required Action

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

Affected Product

Vendor/Project: Cisco
Product: IOS XE Web UI

Ransomware Risk

Known Ransomware Use
KEV Catalog Version: 2025.01.24 Released: January 24, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed CRITICAL

GHSA-4xrf-pcxr-rf3c

Advisory Details

Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system. For steps to close the attack vector for this vulnerability, see the Recommendations section of this advisory  Cisco will provide updates on the status of this investigation and when a software patch is available.

CVSS Scoring

CVSS Score

9.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Advisory provided by GitHub Security Advisory Database. Published: October 16, 2023, Modified: January 25, 2024

Social Media Intelligence

Real-time discussions and threat intelligence from social platforms

8 posts
Reddit 4 days ago
ITGirlJulia

CVE-2023-20198 - CRITICAL (10.0/10) - Oct 16, 2023 - Improper access control in web UI **CVE ID:** CVE-2023-20198 **Published:** 2023-10-16T00:00:00.000Z **Severity:** CRITICAL (10.0/10) ## Description A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to create an account on an affected …

Reddit 1 week, 4 days ago
Electrical_Hat_680

🔐 Salt Typhoon Protocol: A Quantum-Resilient Hash-Based Defense Grid for Critical Infrastructure (CISA/NSA Briefing) 🔐 Salt Typhoon Protocol: A Quantum-Resilient Hash-Based Defense Grid for Critical Infrastructure (CISA/NSA Briefing) --- 🧠 Executive Summary Salt Typhoon is not just a threat—it’s a blueprint for a new kind of cyber warfare. I propose …

Also mentions: CVE-2024-3400
Reddit 1 week, 4 days ago
Electrical_Hat_680

🔐 Salt Typhoon Protocol: A Quantum-Resilient Hash-Based Defense Grid for Critical Infrastructure (CISA/NSA Briefing) --- 🔐 Salt Typhoon Protocol: A Quantum-Resilient Hash-Based Defense Grid for Critical Infrastructure (CISA/NSA Briefing) --- 🧠 Executive Summary Salt Typhoon is not just a threat—it’s a blueprint for a new kind of cyber warfare. I …

Also mentions: CVE-2024-3400
Reddit 1 week, 4 days ago
fruderduck
Exploit

Salt Typhoon Security Hack https://www.forbes.com/sites/emilsayegh/2025/08/30/us-and-allies-declare-salt-typhoon-hack-a-national-defense-crisis/ The FBI and allied international intelligence agencies have declared the Salt Typhoon cyber campaign a national defense crisis after uncovering widespread infiltration of global telecommunications networks by Chinese state-backed hackers. In one of the most sweeping espionage operations ever exposed, Salt Typhoon actors compromised the …

488
55
598.0
View Original High Risk
Reddit 2 weeks, 1 day ago
technadu
Exploit

CISA Issues Global Warning on Chinese State-Sponsored Espionage Campaign A coalition of cybersecurity agencies (U.S., U.K., AU, CA, NZ) has released **Advisory AA25-239A**, detailing a **major cyber espionage operation** attributed to **Chinese state-sponsored actors**. 📌 Key details: * Target sectors: **Telecom, government, transportation**. * Countries affected: U.S., U.K., Australia, Canada, …

2
3
8.0
View Original High Risk
Reddit 2 months, 2 weeks ago
crstux
Exploit

🔥 Top 10 Trending CVEs (26/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-6543](https://nvd.nist.gov/vuln/detail/CVE-2025-6543)** - 📝 Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway whenconfigured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP …

0.0
View Original High Risk
Reddit 2 months, 2 weeks ago
TheBMSss

هجوم سيبراني على Cisco ‏🔴 هجوم سيبراني صيني يستهدف قطاع الاتصالات الكندي عبر ثغرة خطيرة في أنظمة ⁦‪@Cisco‬⁩ ‏مجموعة Salt Typhoon المدعومة من الصين استغلت ثغرة CVE-2023-20198 (خطورة 10/10) لاختراق 3 أجهزة شبكات تابعة لشركة اتصالات كندية في فبراير 2025، مع إعداد أنفاق GRE لجمع بيانات حركة المرور. ‏التقارير تؤكد …

Reddit 2 months, 2 weeks ago
crstux
Exploit

🔥 Top 10 Trending CVEs (25/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-50054](https://nvd.nist.gov/vuln/detail/CVE-2025-50054)** - 📝 Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to …

1
1.0
View Original High Risk

References

HackerOne Reports

offensiveops
MTN Group
Command Injection - Generic
Published: 2023-10-16T15:12:58.735Z
Last Modified: 2025-07-28T19:43:50.747Z
Copied to clipboard!