CVE-2023-20198
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2023-20198. We'll provide specific mitigation strategies based on your environment and risk profile.
CVSS Score
V3.1EPSS Score
v2025.03.14There is a 94.2% chance that this vulnerability will be exploited in the wild within the next 30 days.
Attack Vector Metrics
Impact Metrics
Description
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
Available Exploits
Related News
Cybersecurity researchers at Insikt Group have identified an ongoing cyber espionage campaign by RedMike (also tracked as Salt The post CVE-2023-20198 & CVE-2023-20273: RedMike Attacks 1,000+ Cisco Devices in Global Espionage Campaign appeared first on Cybersecurity News.
Affected Products
Affected Versions:
Known Exploited Vulnerability
This vulnerability is actively being exploited in the wild
Remediation Status
Due Date
Added to KEV
Required Action
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Affected Product
Ransomware Risk
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Advisory provided by GitHub Security Advisory Database. Published: October 16, 2023, Modified: January 25, 2024
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
CVE-2023-20198 - CRITICAL (10.0/10) - Oct 16, 2023 - Improper access control in web UI **CVE ID:** CVE-2023-20198 **Published:** 2023-10-16T00:00:00.000Z **Severity:** CRITICAL (10.0/10) ## Description A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to create an account on an affected …
🔐 Salt Typhoon Protocol: A Quantum-Resilient Hash-Based Defense Grid for Critical Infrastructure (CISA/NSA Briefing) 🔐 Salt Typhoon Protocol: A Quantum-Resilient Hash-Based Defense Grid for Critical Infrastructure (CISA/NSA Briefing) --- 🧠 Executive Summary Salt Typhoon is not just a threat—it’s a blueprint for a new kind of cyber warfare. I propose …
🔐 Salt Typhoon Protocol: A Quantum-Resilient Hash-Based Defense Grid for Critical Infrastructure (CISA/NSA Briefing) --- 🔐 Salt Typhoon Protocol: A Quantum-Resilient Hash-Based Defense Grid for Critical Infrastructure (CISA/NSA Briefing) --- 🧠 Executive Summary Salt Typhoon is not just a threat—it’s a blueprint for a new kind of cyber warfare. I …
Salt Typhoon Security Hack https://www.forbes.com/sites/emilsayegh/2025/08/30/us-and-allies-declare-salt-typhoon-hack-a-national-defense-crisis/ The FBI and allied international intelligence agencies have declared the Salt Typhoon cyber campaign a national defense crisis after uncovering widespread infiltration of global telecommunications networks by Chinese state-backed hackers. In one of the most sweeping espionage operations ever exposed, Salt Typhoon actors compromised the …
CISA Issues Global Warning on Chinese State-Sponsored Espionage Campaign A coalition of cybersecurity agencies (U.S., U.K., AU, CA, NZ) has released **Advisory AA25-239A**, detailing a **major cyber espionage operation** attributed to **Chinese state-sponsored actors**. 📌 Key details: * Target sectors: **Telecom, government, transportation**. * Countries affected: U.S., U.K., Australia, Canada, …
🔥 Top 10 Trending CVEs (26/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-6543](https://nvd.nist.gov/vuln/detail/CVE-2025-6543)** - 📝 Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway whenconfigured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP …
هجوم سيبراني على Cisco 🔴 هجوم سيبراني صيني يستهدف قطاع الاتصالات الكندي عبر ثغرة خطيرة في أنظمة @Cisco مجموعة Salt Typhoon المدعومة من الصين استغلت ثغرة CVE-2023-20198 (خطورة 10/10) لاختراق 3 أجهزة شبكات تابعة لشركة اتصالات كندية في فبراير 2025، مع إعداد أنفاق GRE لجمع بيانات حركة المرور. التقارير تؤكد …
🔥 Top 10 Trending CVEs (25/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-50054](https://nvd.nist.gov/vuln/detail/CVE-2025-50054)** - 📝 Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to …