CVE-2023-20198

What it actually does

This is a remotely exploitable Cisco IOS XE web UI vulnerability that allows an unauthenticated attacker with network access to the management web interface to gain privileged control of the device. In observed attacks, exploitation allowed execution of a privilege level 15 command to create a local user, after which attackers chained a second IOS XE web UI issue to elevate to root and write a web implant to the device file system. Successful exploitation can provide full administrative control of the network appliance, including configuration modification, account creation, traffic interception or redirection, and persistence through unauthorized local accounts or implants.

Why it matters to the business

Compromise of an IOS XE device can affect routing, switching, VPN, wireless controller, and edge connectivity functions, creating risk of network outage, interception of sensitive traffic, unauthorized access to internal networks, and loss of trust in core infrastructure. The vulnerability is known to be exploited in the wild, is listed in CISA KEV with a remediation due date of 2023-10-20, has a CVSS score of 10.0 and very high EPSS probability, so exposed web management interfaces should be treated as urgent incident-response priorities rather than routine patching items.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable Cisco IOS XE web UI service, typically over HTTP or HTTPS. Without valid credentials, the attacker exploits the web UI flaw to issue a privileged command that creates a new local user with a password. The attacker then authenticates using that newly created account and, in observed campaigns associated with the BADCANDY implant and related Cisco IOS XE exploitation activity, chains the access with CVE-2023-20273 to obtain root-level execution and write an implant into the web UI path. The implant can provide command execution or remote control through crafted web requests, while the unauthorized local user gives the attacker a conventional administrative foothold. Attackers may then alter device configuration, collect configuration secrets, pivot into adjacent networks, monitor traffic, or attempt to hide changes by removing obvious artifacts.

How to fix it

Immediately upgrade affected Cisco IOS XE systems to a Cisco fixed release using the Cisco Software Checker and the vendor advisory for CSCwh87343. Disable the HTTP Server and HTTPS Server features on IOS XE devices wherever web UI management is not required using the appropriate IOS XE configuration controls, and restrict management access to trusted management networks, VPNs, or jump hosts only. Remove any unauthorized local users, rotate local and centralized administrative credentials, review privilege assignments, and validate the complete running and startup configurations. Because active exploitation includes implant deployment, patching alone is not sufficient for previously exposed devices; perform compromise assessment and consider reimaging or factory-resetting devices where an implant or unauthorized privileged access is confirmed. The supplied fixed-version metadata also lists sovware/directorist fixed at Git commit e28defba56fbe47b339f37b6537f9473b2f8af68; validate that product mapping before using it as remediation because it does not match the Cisco IOS XE vulnerability description.

How to confirm the fix worked

Confirm that each IOS XE device is running a Cisco fixed release for this vulnerability and that the web UI is disabled or restricted to trusted management sources. Validate configuration with commands that review HTTP/HTTPS server status, local users, AAA configuration, privilege levels, and recent configuration changes. Test externally and from untrusted networks to verify the web UI is not reachable. Review the running configuration and startup configuration for unauthorized users or unexpected management-plane access rules. Where practical, check for the known implant behavior by sending a controlled request to the logout confirmation endpoint and investigating any unexpected hexadecimal response or nonstandard behavior. Confirm that device logs no longer show unexplained web UI logins, configuration changes, or web UI installation activity after remediation.

Typical attack path

1. Scan for Cisco IOS XE devices with the web UI management feature exposed over HTTP or HTTPS.
2. Send a crafted unauthenticated request to the web UI to trigger privileged command execution.
3. Create a local user account, often with privilege level 15 or equivalent administrative capability.
4. Log in to the web UI or device management plane using the attacker-created account.
5. Optionally chain the compromise with the related IOS XE web UI privilege escalation issue to obtain root-level access.
6. Write or activate a web implant such as BADCANDY to provide command execution through crafted HTTP requests.
7. Use administrative access to change configuration, collect secrets, move laterally, or disrupt network operations.
8. Attempt cleanup by deleting users, clearing logs, rebooting, or removing implant artifacts.

How to detect it

Investigate whether the IOS XE web UI was reachable from the internet or untrusted networks during the exposure window. Review device logs for web UI login events, privilege changes, local user creation, configuration writes, web UI installation messages, unexplained reloads, and log gaps. Review AAA, TACACS+, RADIUS, SIEM, firewall, proxy, VPN, and NetFlow records for suspicious HTTP or HTTPS access to device management IPs, especially requests to web UI paths and traffic from unfamiliar external addresses. Compare running and startup configurations against known-good configuration archives for new usernames, changed privilege levels, altered access lists, modified management-plane controls, new certificates, or changed AAA settings. Look for BADCANDY-related behavior by checking whether crafted requests to the web UI logout confirmation endpoint return unexpected hexadecimal output. If an unauthorized local account, implant response, unexplained privilege 15 command, or suspicious web UI access is found, preserve logs and configuration snapshots before cleanup and treat the device as compromised.

• /webui/logoutconfirm.html?logon_hash=
• POST /webui/logoutconfirm.html?logon_hash=
• /webui/login.html
• /usr/binos/conf/nginx-conf/cisco_service.conf
• cisco_tac_admin
• cisco_support
• username cisco_tac_admin privilege 15
• username cisco_support privilege 15
• %WEBUI-6-INSTALL_OPERATION_INFO
• %SYS-5-CONFIG_P
• %SEC_LOGIN-5-WEBLOGIN_SUCCESS
• BADCANDY

What your security team should do

• Treat any internet-exposed IOS XE web UI as potentially compromised and prioritize immediate containment, patching, and forensic review.
• Disable IOS XE web UI management unless there is a clear operational requirement; if required, restrict access to dedicated management networks and enforce strong AAA controls.
• Use Cisco Software Checker to identify exact fixed IOS XE releases and upgrade all affected devices without relying solely on version naming.
• Search for unauthorized local users, especially newly created privilege 15 accounts, and remove them only after preserving evidence.
• Review network device logs, AAA logs, TACACS+/RADIUS records, configuration archives, NetFlow, and firewall logs for suspicious web UI access and post-exploitation activity.
• Rotate administrative credentials and secrets stored on or passing through affected devices after compromise assessment.
• If BADCANDY implant behavior or root-level compromise is suspected, coordinate with network operations to rebuild or reimage the device rather than only deleting visible artifacts.
• Add continuous monitoring for exposed management interfaces and alert on any future HTTP/HTTPS management exposure from untrusted networks.
• Because this vulnerability is KEV-listed, document remediation status and exceptions for governance and regulatory reporting.