CVE-2023-20198

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions prior to October 2023

Description A privilege escalation flaw exists in the web user interface of Cisco IOS XE when exposed to the internet or untrusted networks. This issue allows a remote, unauthenticated attacker to create a local administrator account with privilege level 15, granting full control over the affected system.

Real-world exploitation has been observed by state-sponsored actors, including the Salt Typhoon group, targeting telecommunications providers in the U.S. and Canada to steal configuration files and establish GRE tunnels for traffic collection. In Australia, over 400 devices were potentially compromised with a Lua-based webshell known as BadCandy, which allows root-level command execution. While the webshell is removed upon reboot, attackers can re-infect unpatched devices that keep the web interface accessible. The flaw has also been linked to intrusions affecting approximately 200 organizations across 80 countries.

Recommendations Update Cisco IOS XE to a version released in October 2023 or later. As a temporary mitigation, disable the web user interface on the affected devices.