CVE-2023-20198
Cisco IOS XE Web UI Privilege Escalation Vulnerability
Description
CVE-2023-20198 is a critical privilege escalation vulnerability in the web UI feature of Cisco IOS XE Software. This vulnerability allows an unauthenticated, remote attacker to create a privileged account on affected devices, gaining initial access to the system. The attacker exploits an unprotected alternate channel in the web UI to issue a privilege 15 command, creating a local user and password combination that enables normal user login. CISA has added CVE-2023-20198 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.0%, exploitation is near-certain. Notably, this vulnerability is frequently chained with CVE-2023-20273 to escalate from initial access to full root-level control of the Cisco IOS XE device.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| rockwellautomation | allen-bradley stratix 5200 firmware | < 17.12.02 |
| rockwellautomation | allen-bradley stratix 5800 firmware | < 17.12.02 |
| cisco | ios xe | >= 16.12, < 16.12.10a; >= 17.3, < 17.3.8a; >= 17.6, < 17.6.6a; >= 17.9, < 17.9.4a |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198(US Government Resource)
Weakness Type
CWE-420: Unprotected Alternate Channel
The Cisco IOS XE web UI exposes an unprotected alternate channel that allows attackers to bypass standard authentication mechanisms. In the context of CVE-2023-20198, this weakness enables unauthenticated remote attackers to access privileged administrative functions through the web interface without proper credential validation.
Learn more: CWE-420 — Unprotected Alternate Channel
Impact Analysis
CVE-2023-20198 carries a maximum CVSS score of 10.0 (Critical), reflecting the most severe possible impact. The vulnerability is remotely exploitable without physical access, requires no authentication, involves no user interaction, and is easy to exploit with no special conditions needed. Scope (Changed): a successful exploit can affect resources beyond the vulnerable web UI component, extending to the entire networking device and connected infrastructure. Confidentiality (High): attackers gain access to device configurations, credentials, and sensitive network data. Integrity (High): attackers can modify device configurations, create rogue accounts, and write implants to the file system. Availability (High): full device compromise can lead to service disruption or complete device takeover. With an EPSS score of 94.0%, indicating near-certain exploitation activity, organizations running Cisco IOS XE with the web UI enabled face an immediate and severe risk to their network infrastructure.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-20198 in the wild and has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of October 20, 2023. The EPSS score of 94.0% indicates near-certain exploitation activity, placing this vulnerability in the 99th percentile for exploitation probability. While the ransomware association is currently listed as unknown, the vulnerability is frequently chained with CVE-2023-20273 to achieve full root access — the attacker first uses CVE-2023-20198 to gain initial access and create a local account, then leverages CVE-2023-20273 to elevate privileges to root and deploy an implant on the file system. Vendor advisory and mitigation guidance is available from Cisco.
Remediation
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Cisco has released fixed software versions — consult the Cisco Security Advisory for the complete list of patched releases and use the Software Checker tool to identify the appropriate update for your deployment.
- Disable the HTTP/HTTPS server feature on all internet-facing Cisco IOS XE devices immediately by running and in global configuration mode. This removes the attack surface entirely.
- Audit all local user accounts on Cisco IOS XE devices for unauthorized entries, particularly any accounts created with privilege level 15. Remove any suspicious accounts and rotate credentials for all legitimate administrative accounts.
- Inspect devices for indicators of compromise including unexpected configuration changes, unknown user accounts, and the presence of implants on the file system. Review system logs for evidence of web UI access from unexpected IP addresses and check for artifacts related to the chained exploitation of CVE-2023-20273.
- Restrict management plane access using access control lists (ACLs) to limit web UI access to trusted management networks only. Implement network segmentation to isolate management interfaces from general network traffic.
Technical Details
CVE-2023-20198 exploits an unprotected alternate channel (CWE-420) in the web UI feature of Cisco IOS XE Software, where the web interface exposes administrative functionality without enforcing proper authentication controls. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms that the vulnerability is network-accessible with low attack complexity and requires neither privileges nor user interaction, while the changed scope indicates impact beyond the web UI component itself. An attacker sends crafted requests to the web UI to issue a privilege 15 command — the highest privilege level in Cisco IOS — which creates a local user account with full administrative access. This initial compromise through CVE-2023-20198 is then chained with CVE-2023-20273, which leverages the newly created account to exploit another component of the web UI feature, escalating privileges to root level and writing a persistent implant to the device file system.
Frequently Asked Questions
Is CVE-2023-20198 being actively exploited?
Yes, CVE-2023-20198 is being actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 20, 2023. The EPSS score of 94.0% further confirms widespread exploitation activity, though ransomware association is currently listed as unknown.
What products are affected by CVE-2023-20198?
CVE-2023-20198 affects Cisco IOS XE Software with the web UI feature enabled. Additionally, Rockwell Automation Allen-Bradley Stratix 5200 and Stratix 5800 firmware, which are based on Cisco IOS XE, are also affected. Organizations using any of these products with the HTTP/HTTPS server feature enabled should take immediate action.
How do I fix CVE-2023-20198?
The primary remediation is to apply the fixed software releases identified in Cisco's security advisory. As an immediate mitigation, disable the HTTP/HTTPS server on affected devices using and . Audit all local accounts for unauthorized entries and restrict management access to trusted networks using ACLs.
How severe is CVE-2023-20198?
CVE-2023-20198 is rated Critical with the maximum CVSS score of 10.0 out of 10.0, reflecting unauthenticated remote code execution with full impact on confidentiality, integrity, and availability. It ranks in the 99th percentile for exploitation probability (EPSS), making it one of the most actively targeted vulnerabilities. The severity is compounded by its use in a chained attack with CVE-2023-20273 that achieves root-level device compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.