Cisco IOS XE Web UI Privilege Escalation + Command Injection
- Product
- Cisco IOS XE Web UI
- CVE
- CVE-2023-20198CVE-2023-20273
- Disclosed
- 2023-10-16
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Cisco IOS XE with the HTTP/HTTPS server feature enabled.
- Fixed
- 17.9.4a, 17.6.6a, 17.3.8a, 16.12.10a and later.
Summary
Talos found attackers creating privilege-15 accounts on IOS XE devices via the Web UI and then implanting a Lua backdoor. Over 40,000 routers and switches were compromised within days.
Root cause
CVE-2023-20198: a double-URL-encoding flaw let unauthenticated requests reach an internal web services management endpoint that executes CLI commands at privilege 15. CVE-2023-20273: a command injection in a Web UI feature allowed writing the implant to the filesystem as root.
Impact
Full device control, persistent implant and traffic interception on network infrastructure.
Detection
Check for unknown local users and 'ip http server' config; Cisco published an implant check: an HTTP POST to /webui/logoutconfirm.html?logon_hash=1 that returns a hex string. Nuclei template CVE-2023-20198.
Mitigation
Upgrade, and disable 'ip http server' / 'ip http secure-server' on internet-facing devices.