Cisco Warns of Critical Vulnerability in IOS XE Software
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) CVE-2023-20198 is a critical (CVSS 10.0) unauthenticated privilege escalation flaw in the web UI of Cisco IOS XE software, triggered by sending crafted network requests to the exposed web management interface. An attacker with no credentials can use the flaw to gain initial access and issue a privilege 15 command, creating a local user with normal login access; the attacker then chained CVE-2023-20273 (CVSS 7.2) to elevate that account to root and write an implant to the file system. Successful exploitation yields full administrative control of the device, including persistence via the planted implant, on Cisco IOS XE devices with the web UI enabled and reachable from the internet or untrusted networks, including Rockwell Automation Allen-Bradley Stratix 5200 and 5800 switches running IOS XE. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-10-16 with a BOD 23-02 directive, EPSS stands at 99.6% (100th percentile), and ongoing campaigns (including the 'BADCANDY' activity flagged by Australia's ASD and Cisco-related telecom intrusions attributed to Salt Typhoon) have been reported. Do: Upgrade affected devices to the fixed releases listed in Cisco's advisory (use Cisco's Software Checker) and, as immediate mitigation, disable the web UI or restrict it to trusted networks/addresses only. Check for compromise by looking for unexpected local user accounts and the implant artifacts Cisco identified (unexpected cisco_tac_alarm.log and cisco_tac.log files in /tmp or /usr/binos/conf), and immediately report positive findings to CISA per BOD 23-02. Keep in mind that patching alone does not remove a root implant, so devices with evidence of compromise should be reimaged or otherwise cleaned per vendor instructions. | 10.0 | 100% | KEV |
| large≈40,000–50,000 internet-exposed IOS XE devices at the time of disclosure (public scan data), within an IOS XE install base in the millions |
Full article385 words · extracted from infosecurity-magazine.com · click to collapse
Cisco has issued an urgent warning about the active exploitation of a critical vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software.
The tech giant has urged affected organizations to immediately implement guidance set out in its advisory, published on October 16, to mitigate the threat.
The vulnerability, CVE-2023-20198, has the highest possible CVSS severity rating of 10. Successful exploitation enables an attacker to create an account on the affected device with a privilege 15 access. This effectively grants them full control of the compromised device, paving the way for subsequent unauthorized activity.
The flaw affects both physical and virtual devices running Cisco IOS XE software that also have the HTTP or HTTPS Server feature enabled.
The software must also be exposed to the internet or untrusted networks for exploitation to occur.
How Exploitation Occurs
Cisco Talos first discovered evidence of potentially malicious activity on a customer device from September 28 to October 1, 2023.
On October 12, the team detected an additional cluster of related activity, in which an unauthorized user was observed creating a local user account under the name ‘cisco_support’ from a second suspicious IP address.
This activity included several subsequent actions, such as the deployment of an implant consisting of a configuration file. The configuration file defines the new web server endpoint used to interact with the implant, and this endpoint receives certain parameters that allows the execution of arbitrary commands at the system level or IOS level.
The new user accounts created from this implant gives attackers full administrator access to the device.
Cisco believe that these clusters of activity were likely carried out by the same actor.
How to Mitigate the Vulnerability
Cisco set out the following recommendations for organizations using IOS XE software to mitigate against exploitation.
- Disable the HTTP Server feature on all internet-facing systems, which is consistent with guidance the US government has provided in the past on mitigating risk from internet-exposed management interfaces.
- Look for unexplained or newly created users on devices as evidence of potentially malicious activity relating to this threat. Cisco advised running the command curl ‘-k -X POST "https[:]//DEVICEIP/webui/logoutconfirm.html?logon_hash=1"’ against the device to identify if the implant is present.
- Continue monitoring Cisco’s advisory for further updates around exploitation and public announcements as more information becomes available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisco-critical-vulnerability-ios/