Honeypot logs Cisco IOS web UI scans suspected as CVE-2023-20198
Original title: Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)
SOAP posts to the web UI try to run uname -a and carry RootEvidence opt-out headers.
A SANS Internet Storm Center honeypot recorded POST requests to a Cisco IOS web UI SOAP path that attempt to run uname -a. The author suspects the traffic targets CVE-2023-20198 and says it is not new. The client identifies as RootEvidence/1.0 and sends Opt-Out-Email and Opt-Out-Url headers. The path URL-encodes the leading character of webui_wsma_https.
Unconfirmed: The author only suspects the scans are for CVE-2023-20198.
- The request targets /%77ebui_wsma_https on port 8000.
- The SOAP body contains the command uname -a.
- Opt-out headers name re-abuse@rootevidence.com and rootevidence.com/scanners.
- The author says RootEvidence has used those headers since December last year.
Impact: Attempted command execution through the web UI
| Product | Affected |
|---|---|
| Cisco IOS | — |
- CVEs
- CVE-2023-20198
- Vendors
- Cisco
- Products
- Cisco IOS
- Organizations
- RootEvidence
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) | 10.0 | 100% | KEV | KEV |
From the original article
1 min read at isc.sans.eduThis morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.