[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Cisco's Zero-Day Vulnerability (CVE-2023-20198)](/blog/cisco-cve-2023) Publish date November 19, 2024 {x} minute read # Cisco's Zero-Day Vulnerability (CVE-2023-20198) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Caitlin Postal](/team/caitlin-postal) Technical Writer Reviewed by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Table of contents Free resource ### [Download now](#) Cisco has [released a Product Security Incident Response Team (PSIRT) advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z) regarding a zero-day vulnerability in the web UI feature of Cisco IOS XE software. Cisco has stated that the web-based user interface should never be accessible through the public internet, yet [research indicates that a large number of Cisco devices have been exploited by an unknown threat actor](https://arstechnica.com/security/2023/10/actively-exploited-cisco-0-day-with-maximum-10-severity-gives-full-network-control/). This critical vulnerability is being tracked as [CVE-2023-20198](https://nvd.nist.gov/vuln/detail/CVE-2023-20198) and is currently undergoing investigation for active exploitation. At the original time of publication, there was no software patch available for affected devices with vulnerable systems exposed to the internet or to untrusted networks, but Cisco released a software update for version 17.9.4a on October 25, 2023, with forthcoming updates for versions 17.6, 17.3, and 16.12. ## What is CVE-2023-20198? CVE-2023-20198 is a critical, unpatched vulnerability impacting Internet-facing IOS XE systems. The web UI provides a graphical management system for networking deployment on Cisco devices, such as routers and wireless controllers. All Cisco networking devices running the IOS XE service with the web user interface feature enabled are at risk of the web UI privilege escalation vulnerability. > "This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system," reported in the [Cisco security advisory.](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z) If successfully exploited, this vulnerability enables unauthorized attackers to create new accounts with full administrator privileges through a privilege escalation issue. The unauthorized administrator accounts are persistent, which means they remain in the system even if the device is restarted. Cisco, [in the Talos Intelligence report](https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/), identified initial privilege escalation with unauthorized administrator accounts that later deployed a configuration file and exploited the previously patched [CVE-2021-1435](https://nvd.nist.gov/vuln/detail/CVE-2021-1435). The attacker can leverage this implant to achieve arbitrary command execution if the implant is successfully installed. The web server must be restarted for the implant to function. With heightened administrator privileges and the potential to achieve arbitrary code execution, an attacker could gain control over the system. Cisco's PSIRT advisory sets a critical CVSS score of 10. The vulnerability is still undergoing analysis in the National Vulnerability Database and does not yet highlight which common weakness enumerations (CWEs) are present in the vulnerability. This vulnerability has been added to CISA's [Known Exploited Vulnerabilities catalog](https://cisa.gov/known-exploited-vulnerabilities-catalog). US federal agencies impacted by this vulnerability must adhere to the requirements of CISA's [Binding Operational Directive 23-02](https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02). CVE-2023-20198 follows an existing [input validation and injection attack vulnerability identified in September 2023 impacting the same software](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdij-FzZAeXAy). Cisco has released software updates for the September vulnerability, which is tracked as [CVE-2023-20231](https://nvd.nist.gov/vuln/detail/CVE-2023-20231). ## How to Detect Cisco IOS XE Software Web UI with UpGuard If you use the IOS XE software with an internet-facing administrative management portal, your system may be at risk. UpGuard has added the following risk detection findings related to CVE-2023-20198: * Known exploited vulnerability for **CVE-2023-20198** * **Cisco IOS XE Web UI is running** * **Indicator of system compromise in Cisco IOS XE Web UI** By adding these three risks to our scanning capabilities, UpGuard can notify users of potential exposure in your attack surface resulting from your use of Cisco IOS XE Software Web UI and the current vulnerability. You can review your risk profile within UpGuard to identify whether you or a vendor are using Cisco IOS XE Software Web UI exposed to the internet. If you receive any of these risk findings, you should take immediate action to set up protections against potential compromise as this vulnerability is being actively exploited. ## Recommended Mitigations Cisco advises customers to [upgrade the system to a fixed software release](https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html). The update for version 17.9.4 has been released, with more versions to follow in the near future. Per the [Cisco security advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z), you should immediately disable the HTTP Server feature if it is currently in use. Consult with your security team and follow your cybersecurity [incident response plan](https://www.upguard.com/blog/creating-a-cyber-security-incident-response-plan) as you work to mitigate potential security impacts and protect against potential malicious activity resulting from this vulnerability. ### Disable the HTTP Server Feature To disable the HTTP Server feature, determine whether the feature is enabled by running this command in your terminal: \[.rt-script]show running-config | include ip http server|secure|active\[.rt-script] If your command-line terminal returns the \[.rt-script]ip http server\[.rt-script] command or the \[.rt-script]ip http secure-server\[.rt-script] command, then your system is affected. One or both commands indicates that the web UI is enabled on your system. Note that if you are able to access the web-based user interface, your system is likely affected by this vulnerability. Cisco recommends using the \[.rt-script]no ip http server\[.rt-script] or \[.rt-script]no ip http secure-server\[.rt-script] commands in global configuration mode to disable the web interface. If both are in use, both commands are required to disable the feature. If you run services that require continued access, restrict those services to trusted networks while you evaluate whether your system has been exploited. ### Check for Indicators of Compromise Cisco's PSIRT advisory includes actionable commands to identify potential compromise and access control issues among Cisco devices on your system. Review the following indicators of compromise (IOCs) on your internet-facing systems. Inspect administrative users for any unauthorized or newly created users. Threat actors have used \[.rt-script]cisco\_tac\_admin\[.rt-script] and \[.rt-script]cisco\_support\[.rt-script] for local user accounts in an attempt to evade detection. In addition to reviewing administrator accounts, Cisco recommends checking system logs for evidence of any configured, local user unknown to your network administrator. Review the **user** in the following two log messages for instances of compromise: * \[.rt-script]%SYS-5-CONFIG\_P: Configured programmatically by process SEP\_webui\_wsma\_http from console as user on line\[.rt-script] - \[.rt-script]%SEC\_LOGIN-5-WEBLOGIN\_SUCCESS: Login Success \[user: user] \[Source: source\_IP\_address] at 03:42:13 UTC Wed Oct 11 2023\[.rt-script] Compromised users may include \[.rt-script]cisco\_tac\_admin\[.rt-script], \[.rt-script]cisco\_support\[.rt-script], or any unknown local user. Investigate any new or unknown usernames that appear. Because file implantation by threat actors has been identified in compromised systems, you can also review system logs for any unexpected **filename** installation in the following message: \[.rt-script]%WEBUI-6-INSTALL\_OPERATION\_INFO: User: username, Install Operation: ADD filename\[.rt-script] Additionally, Cisco Talos recommends assessing whether the impact is present on your system by running the following command (replacing **systemip** with the IP address for the system you want to check): \[.rt-script]curl -k -X POST "https\://systemip/webui/logoutconfirm.html?logon\_hash=1"\[.rt-script] Cisco advises that the implant is present on the system if the request returns a hexadecimal string. If you cannot find the aforementioned indicators of compromise, [evidence of the malicious implant may have been hidden](https://www.bleepingcomputer.com/news/security/hackers-update-cisco-ios-xe-backdoor-to-hide-infected-devices/) following the news of the vulnerability. [Fox IT has released a supplemental script to investigate the implant’s presence](https://github.com/fox-it/cisco-ios-xe-implant-detection) through a fingerprinting method. As with all scripts from external organizations, review your security measures before running new code. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 26, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)