Cisco IOS XE Web UI unprotected alternate channel

Summaryinfo

A vulnerability, which was classified as very critical, was found in Cisco IOS XE. This affects an unknown function of the component Web UI. Executing a manipulation can lead to an unknown weakness. This vulnerability is tracked as CVE-2023-20198. The attack can be launched remotely. Moreover, an exploit is present. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability classified as very critical was found in Cisco IOS XE (Router Operating System) (affected version not known). This vulnerability affects some unknown functionality of the component Web UI. The CWE definition for the vulnerability is CWE-420. The product protects a primary channel, but it does not use the same level of protection for an alternate channel. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

The weakness was disclosed 10/16/2023 as cisco-sa-iosxe-webui-privesc-j22SaA4z. The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability was named CVE-2023-20198 since 10/27/2022. Technical details are unknown but an exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/28/2025).

It is declared as attacked. This issue was added on 10/16/2023 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 10/20/2023:

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determ

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Zero-Day.cz (827). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion