critical 10.0

CVE-2023-20198 kev in the critical feed json

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.

published 2023-10-16 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24377

cvss: 10.0; version 3.1, CNA
cisa kev: Exploited; added 2023-10-16
epss: 99.8%; EPSS 99.8% chance of exploitation in 30 days, percentile 99.9%
public exploits: 3; Metasploit, plus a Nuclei check

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

Patch / fix

cisa required action Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

fixed in 3

rockwellautomation allen-bradley_stratix_5200_firmware 17.12.02
rockwellautomation allen-bradley_stratix_5800_firmware 17.12.02
cisco ios_xe 16.12.10a, 17.3.8a, 17.6.6a, 17.9.4a

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-297-01 updated 2023-11-21 cvss 10.0

Rockwell Automation Stratix 5800 and Stratix 5200 (UPDATE A)

Rockwell Automation Stratix 5200 (running Cisco IOS XE Software with the Web UI feature enabled) Rockwell Automation Stratix 5800 (running Cisco IOS XE Software with the Web UI feature enabled)
affected: mitigation “Rockwell Automation strongly encourages customers to follow guidance disabling Stratix HTTP servers on all internet-facing systems.” blog.talosintelligence.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

2023-10-16 First public exploit (Metasploit auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198)
2023-10-16 Added to CISA KEV
2023-10-16 Published
2023-10-20 CISA patch deadline
2024-10-23 CISA SSVC: exploitation active

Known exploited

Added: 3 y ago (2023-10-16)
Patch by: 2023-10-20 (3 y ago)
Ransomware: Not known
Required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Vendor, product: Cisco, IOS XE Web UI
CISA name: Cisco IOS XE Web UI Privilege Escalation Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1190 Exploit Public-Facing Application exploitation
T1136 Create Account primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 2 y ago (2024-10-23)

Exploit prediction

99.78% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198 Cisco IOX XE unauthenticated Command Line Interface (CLI) execution metasploit auxiliary, normal rank, 2023-10-16
Metasploit auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273 Cisco IOX XE unauthenticated OS command execution metasploit auxiliary, normal rank, 2023-10-16
Metasploit exploit/linux/misc/cisco_ios_xe_rce Cisco IOX XE Unauthenticated RCE Chain metasploit exploit, excellent rank, 2023-10-16
Nuclei template Cisco IOS XE Web UI - Command Injection nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Cisco Cisco IOS XE Software

Classification

Weakness

CWE-420 Unprotected Alternate Channel

Technology feeds

Cisco IOS rss critical rss

References

sec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
mitigation, vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198
government-resource, us-government-resource

Sources

CVE List CVE-2023-20198
NVD CVE-2023-20198

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary