{"id":"CVE-2023-20198","published":"2023-10-16T16:15:10Z","modified":"2026-06-17T05:29:47Z","title":"Cisco IOS XE Web UI Privilege Escalation Vulnerability","vendor":"Cisco","product":"IOS XE Web UI","tier":"core","eol":null,"description":{"text":"Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.","provenance":"source","from":"NVD"},"summary":{"text":"Cisco IOS XE Web UI contains a flaw that lets an attacker escalate privileges through the web UI feature after gaining initial access, with the flaw being exploited in observed attacks. An attacker on the network with no prior authentication and no user interaction can abuse this weakness, and the write of an implant to the file system indicates the attacker can then gain root-level control of the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:06:56Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99613,"percentile":0.99948,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-10-16","dueDate":"2023-10-20","ransomware":false,"requiredAction":"Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.","notes":"https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-20198","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-10-16","exploitedFirstSeen":"2023-10-16","ransomware":true,"evidence":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2023-10-16"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-10-16"},{"url":"https://www.rapid7.com/blog/post/2023/10/17/etr-cve-2023-20198-active-exploitation-of-cisco-ios-xe-zero-day-vulnerability/","date":"2023-10-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2023-20198","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2023-20198","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2023-20198","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2023-20198","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-17&host_type=src&vulnerability=cve-2023-20198","date":"2023-11-17"}],"evidenceTotal":1126,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-420","name":"Unprotected Alternate Channel"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","tags":["Mitigation","Vendor Advisory"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through improper access control in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to gain initial access by issuing a privilege level 15 command, which allowed them to create a local user account with a password. ","confidence":"high"},{"id":"T1136","name":"Create Account","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through improper access control in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to gain initial access by issuing a privilege level 15 command, which allowed them to create a local user account with a password. ","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"machine","basis":"report-attack-id","bases":["report-attack-id"],"basisDetail":"ATT&CK ID T1068 written in the same sentence as CVE-2023-20198","mappingType":null,"evidence":[{"reportId":"SRC-8d5517bedbda024608fa","quote":"CVE-2023-20273 - Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation (commonly chained with CVE-2023-20198 for initial access to achieve code execution as root) [T1068]","start":8581,"end":8843}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-d6831d4223ab36771b1a","title":"Weathering the storm: In the midst of a Typhoon","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","date":"2025-02-20","mentions":[{"quote":"CVE-2023-20198, CVE-2023-20273 - Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature (Last Updated: 1-Nov-2023)","start":2347,"end":2471}]},{"id":"SRC-8d5517bedbda024608fa","title":"Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a","date":null,"mentions":[{"quote":"CVE-2023-20273 - Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation (commonly chained with CVE-2023-20198 for initial access to achieve code execution as root) [T1068]","start":8581,"end":8843},{"quote":"CVE-2023-20198 - Cisco IOS XE web user interface authentication bypass vulnerability","start":8847,"end":8931},{"quote":"While exploiting CVE-2023-20198, the APT actors used the Web Services Management Agent (WSMA) endpoints /webui_wsma_Http or /webui_wsma_Https to bypass authentication and create unauthorized administrative accounts.","start":8935,"end":9150},{"quote":"While exploiting CVE-2023-20198, the APT actors used the Web Services Management Agent (WSMA) endpoints /webui_wsma_Http or /webui_wsma_Https to bypass authentication and create unauthorized administrative accounts.","start":9840,"end":10055},{"quote":"Enabling HTTP/HTTPS servers on Cisco devices affected by CVE-2023-20198.","start":14437,"end":14509}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-24377","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24377","exploited":true,"exploitedSince":"2023-10-16","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":28,"skipped":8,"earliest":"2023-10-17","earliestUrl":"https://github.com/Atea-Redteam/CVE-2023-20198","repos":[{"name":"smokeintheshell/CVE-2023-20198","url":"https://github.com/smokeintheshell/CVE-2023-20198","stars":67,"created":"2023-11-16"},{"name":"W01fh4cker/CVE-2023-20198-RCE","url":"https://github.com/W01fh4cker/CVE-2023-20198-RCE","stars":44,"created":"2024-04-25"},{"name":"fox-it/cisco-ios-xe-implant-detection","url":"https://github.com/fox-it/cisco-ios-xe-implant-detection","stars":41,"created":"2023-10-23"},{"name":"Shadow0ps/CVE-2023-20198-Scanner","url":"https://github.com/Shadow0ps/CVE-2023-20198-Scanner","stars":33,"created":"2023-10-23"},{"name":"ZephrFish/CVE-2023-20198-Checker","url":"https://github.com/ZephrFish/CVE-2023-20198-Checker","stars":32,"created":"2023-10-17"}]},"metasploit":[{"name":"Cisco IOX XE unauthenticated Command Line Interface (CLI) execution","module":"auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198","type":"auxiliary","disclosureDate":"2023-10-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb"},{"name":"Cisco IOX XE unauthenticated OS command execution","module":"auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273","type":"auxiliary","disclosureDate":"2023-10-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb"},{"name":"Cisco IOX XE Unauthenticated RCE Chain","module":"exploit/linux/misc/cisco_ios_xe_rce","type":"exploit","disclosureDate":"2023-10-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/cisco_ios_xe_rce.rb"}],"nuclei":[{"id":"CVE-2023-20198","name":"Cisco IOS XE Web UI - Command Injection","severity":"critical","path":"http/cves/2023/CVE-2023-20198.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20198.yaml"}],"first":{"date":"2023-10-16","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1136"],"provenance":"source"},{"stage":"observed","techniques":["T1068"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2023-10-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20198","provenance":"source"},{"date":"2023-10-16","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-10-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb","provenance":"source"},{"date":"2023-10-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","provenance":"source"},{"date":"2023-10-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-10-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24377","provenance":"source"},{"date":"2025-02-20","kind":"report","label":"Named in blog.talosintelligence.com: Weathering the storm: In the midst of a Typhoon","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","provenance":"machine"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":86.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1111 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"28 PoC-in-GitHub repos; 3 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}