{"slug":"cisco-ios-xe-webui","title":"Cisco IOS XE Web UI (CVE-2023-20198)","shortName":"Cisco IOS XE Web UI","summary":"Critical privilege escalation in the Cisco IOS XE Web UI, chained with CVE-2023-20273 to install the BadCandy implant. CVSS 10.0. Actively exploited from September 2023. Both CVEs listed in CISA KEV.","isExample":false,"draft":false,"family":"cisco-ios-xe-webui","kind":"single-product","aliases":["CVE-2023-20198","CVE-2023-20273","BadCandy"],"publishedAt":"2023-10-16","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2023-20198","cvss":{"cve":"CVE-2023-20198","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-20198","sourceDate":"2026-06-17","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2023-20198","score":0.99609,"percentile":0.99949,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20198","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2023-20198","listed":true,"dateAdded":"2023-10-16","dueDate":"2023-10-20","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Critical privilege escalation in the Cisco IOS XE Web UI (CVE-2023-20198), chained with CVE-2023-20273 to drop the BadCandy implant. Both CVEs are in CISA KEV and were exploited from September 2023.","action":"Confirm HTTP Server is disabled or restricted on internet-facing IOS XE, that devices are on a fixed release, and that implant and rogue-user checks have been run."},"seenInTheWild":[{"metric":"compromised","value":34140,"observer":"Censys","date":"2023-10-17","method":"Censys scan for implant on Cisco IOS XE Web UI hosts; 34,140 of 67,445 Web UI hosts","sourceUrl":"https://www.cybersecuritydive.com/news/cisco-IOS-XE-exploited-no-patch/697188/"},{"metric":"exposed","value":67445,"observer":"Censys","date":"2023-10-17","method":"Total hosts running the Cisco IOS XE Web UI seen by Censys","sourceUrl":"https://www.cybersecuritydive.com/news/cisco-IOS-XE-exploited-no-patch/697188/"},{"metric":"compromised","value":41983,"observer":"Censys","date":"2023-10-18","method":"Censys implant scan","sourceUrl":"https://therecord.media/cisco-ios-xe-vulnerability-patches-coming"},{"metric":"compromised","value":36541,"observer":"Censys","date":"2023-10-19","method":"Censys implant scan (\"by Thursday\", i.e. 19 Oct 2023)","sourceUrl":"https://therecord.media/cisco-ios-xe-vulnerability-patches-coming"},{"metric":"compromised","value":"over 32.8K Cisco IOS XE IPs compromised with implants","observer":"Shadowserver","date":"2023-10-18","method":"Cisco-published implant check","sourceUrl":"https://twitter.com/Shadowserver/status/1714483336876355873","note":"Post date from EclecticIQ citation (accessed 18 Oct 2023)."},{"metric":"compromised","value":30487,"observer":"Shadowserver","date":"2023-10-23","method":"Improved implant detection after actor modified implant","sourceUrl":"https://www.techtarget.com/cybersecurity/news/366556900/Cisco-IOS-XE-instances-still-under-attack-patch-now"},{"metric":"compromised","value":28910,"observer":"Censys","date":"2023-10-25","method":"Revised, less precise /%25 response check across 135,000+ Cisco-like hosts","sourceUrl":"https://censys.com/blog/cisco-ios-xe-ten-days-later/"},{"metric":"compromised","value":"around 15 000 Cisco IOS XE devices backdoored with the implant","observer":"Shadowserver","date":"2025-11-03","method":"Implant (BADCANDY) detection scans","sourceUrl":"https://infosec.exchange/@shadowserver/115487606358169005"},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2023-10-16","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Cisco IOS XE Privilege Escalation Attempt","url":"https://viz.greynoise.io/tags/cisco-ios-xe-privilege-escalation-attempt","observer":"GreyNoise","metric":"scanning"},{"title":"Cisco IOS XE Backdoor Scanner","url":"https://viz.greynoise.io/tags/cisco-ios-xe-backdoor-scanner","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2023-20198 is a privilege escalation vulnerability in the web UI feature of Cisco IOS XE Software. Cisco rates it CVSS 10.0. Attackers used it to create local privilege-15 user accounts, then chained CVE-2023-20273 (CVSS 7.2 command injection) to write the BadCandy implant as root.\n\nThe web UI is exposed when ip http server or ip http secure-server is configured. Cisco Talos observed related activity as early as 18 Sep 2023, with a TAC case on 28 Sep 2023, and a second cluster creating cisco_support accounts from 12 Oct 2023. Cisco published the advisory on 16 Oct 2023. Fixed trains include 17.9.4a, 17.6.6a, 17.3.8a, and 16.12.10a (Catalyst 3650/3850).","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"webui","label":"Web UI exposed","detail":"HTTP or HTTPS Web UI is enabled on an internet-facing or reachable IOS XE device."},{"id":"priv","label":"Privilege escalation","detail":"CVE-2023-20198 lets an unauthenticated attacker create a local privilege-15 user."},{"id":"inject","label":"Command injection","detail":"CVE-2023-20273 elevates to root and writes the BadCandy implant under nginx config paths."},{"id":"implant","label":"Implant control","detail":"BadCandy provides implant interaction endpoints. The implant is non-persistent across reboot; local users remain."}]},"exploitation":{"kev":{"listed":true,"date":"2023-10-16","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV lists CVE-2023-20198 (dateAdded 2023-10-16) and CVE-2023-20273 (dateAdded 2023-10-23)."},"firstSeen":{"date":"2023-09-18","source":"Cisco Talos","note":"Cisco Talos later determined related activity began as early as 18 Sep 2023. A TAC case identifying unusual behavior was opened 28 Sep 2023."},"vendorStatements":[{"vendor":"Cisco","date":"2023-10-16","statement":"Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","retracted":false},{"vendor":"Cisco Talos","date":"2023-10-16","statement":"We discovered early evidence of potentially malicious activity on Sept. 28, 2023... we observed what we have determined to be related activity as early as Sept. 18.","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","retracted":false}]},"timeline":[{"date":"2023-09-18","event":"Cisco Talos later assesses related malicious activity began as early as this date.","source":{"title":"Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","publisher":"Cisco Talos"},"kind":"exploited","key":true},{"date":"2023-09-28","event":"Cisco TAC case opened after unusual behavior on a customer device.","source":{"title":"Active exploitation of Cisco IOS XE Software","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","publisher":"Cisco Talos"},"kind":"exploited","key":true},{"date":"2023-10-12","event":"Second cluster observed creating local user cisco_support from suspicious infrastructure.","source":{"title":"Active exploitation of Cisco IOS XE Software","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","publisher":"Cisco Talos"},"kind":"exploited","key":true},{"date":"2023-10-16","event":"Cisco publishes the advisory. CISA adds CVE-2023-20198 to KEV.","source":{"title":"Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","publisher":"Cisco"},"kind":"kev","key":true},{"date":"2023-10-22","event":"Cisco begins rolling out fixes for CVE-2023-20198 and CVE-2023-20273.","source":{"title":"Active exploitation of Cisco IOS XE Software","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","publisher":"Cisco Talos"},"kind":"patch","key":true},{"date":"2023-10-23","event":"CISA adds CVE-2023-20273 to KEV.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true},{"date":"2023-10-30","event":"Horizon3 publishes a deep dive and PoC discussion for CVE-2023-20198.","source":{"title":"Cisco IOS XE CVE-2023-20198: Deep Dive and POC","url":"https://horizon3.ai/attack-research/attack-blogs/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/","publisher":"Horizon3"},"kind":"poc","key":true}],"defenderActions":[{"title":"Disable or restrict the HTTP Server feature","detail":"Cisco recommends no ip http server and/or no ip http secure-server on internet-facing systems, or restricting access with an HTTP access class to trusted networks, until devices are upgraded.","priority":"now","links":[{"label":"Cisco advisory","href":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z"}]},{"title":"Upgrade to a fixed IOS XE release","detail":"Move to first fixed releases such as 17.9.4a, 17.6.6a, 17.3.8a, or 16.12.10a (Catalyst 3650/3850), or apply the SMUs Cisco lists for 17.9.4 and 17.6.5. Use the Cisco Software Checker for platform-specific guidance.","priority":"now"},{"title":"Check for BadCandy and unknown local users","detail":"Run Cisco's implant check against the Web UI, review logs for unknown users such as cisco_tac_admin or cisco_support, and remove unauthorized local accounts. Reboot clears the non-persistent implant but not the accounts.","priority":"soon","links":[{"label":"Cisco Talos analysis","href":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/"}]}],"detection":[{"title":"Unknown Web UI logins and programmatic config","detail":"Cisco lists %SEC_LOGIN-5-WEBLOGIN_SUCCESS and %SYS-5-CONFIG_P messages with unknown usernames (examples: cisco_tac_admin, cisco_support) as compromise indicators.","logSource":"Device syslog","kind":"generic","group":"web-proxy"},{"title":"Unexpected WEBUI install operations","detail":"Look for %WEBUI-6-INSTALL_OPERATION_INFO messages referencing unknown filenames.","logSource":"Device syslog","kind":"generic","group":"web-proxy"},{"title":"BadCandy implant presence check","detail":"Cisco documents HTTP checks against /webui/logoutconfirm.html?logon_hash=1 (and later Authorization / X-Csrf-Token variants). A hexadecimal string response indicates a known implant variant.","logSource":"Web access logs / reverse-proxy logs","kind":"generic","group":"web-proxy"},{"title":"NetScaler WAF signature: 998597","detail":"NetScaler WAF signature update version 117: rule 998597 (WEB-MISC Cisco IOS XE authentication bypass) for CVE-2023-20198.","logSource":"NetScaler WAF (AppFw) logs","kind":"vendor-signature","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-117.html","date":"2026-10-23","dateKind":"checked"},{"title":"F5 attack signature: 200013068","detail":"Cisco IOS XE Authorization Bypass (200013068), references CVE-2023-20198, last update 2023-11-13.","logSource":"F5 Advanced WAF / Distributed Cloud WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2023-11-13"},{"title":"Fortinet FortiWeb: 1090501923 / 1090501927 / 1090501925","detail":"FortiWeb signatures Cisco.IOS.XE.Web.UI.Backdoor (1090501923, 2023-10-31), Unauthorized.Account.Creation (1090501927, 2023-11-15) and REST.Command.Injection (1090501925, CVE-2023-20273, 2023-11-15).","logSource":"FortiWeb attack logs","kind":"vendor-signature","url":"https://www.fortiguard.com/outbreak-alert/cisco-ios-xe-web-ui-vulnerability","date":"2026-10-23","dateKind":"checked"},{"title":"Check Point IPS: CPAI-2023-0927","detail":"Protection 'Cisco IOS XE Authentication Bypass (CVE-2023-20198)', published 2023-10-18.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2023/cpai-2023-0927.html","date":"2023-10-18"},{"title":"Cisco Talos Snort: 3:50118 / 3:62527-62529 / 3:62541-62542","detail":"Cisco Talos published Snort rule IDs covering implant installation, implant interaction, and initial-access attempts for these CVEs.","logSource":"Snort / Cisco IPS event logs","kind":"vendor-signature","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16"},{"title":"Fortinet FortiGuard IPS: 54224 / 54316 / 54336","detail":"IPS signatures Cisco.IOS.XE.Web.UI.Backdoor (54224, 2023-10-19), Unauthorized.Account.Creation (54316, 2023-11-01), REST.Command.Injection (54336, CVE-2023-20273, 2023-11-02).","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2023-20198&engine=1","date":"2023-10-31"},{"title":"Juniper IDP: HTTP:CTS:CISCO-IOS-XE-EOP, HTTP:CISCO:IOS-WEB-AUTH-BYPASS","detail":"IDP signatures referencing CVE-2023-20198 and CVE-2023-20273. Release dates 2023-10-26 and 2024-01-08.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:CISCO-IOS-XE-EOP.html","date":"2023-10-26"},{"title":"Palo Alto Networks Threat Prevention: 86807 / 94454","detail":"Threat IDs 86807 and 94454 for CVE-2023-20198 per Unit 42 threat brief.","logSource":"Palo Alto Networks threat logs (Threat Prevention / NGFW)","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/threat-brief-cve-2023-20198-cisco-ios-xe/","date":"2023-10-18"},{"title":"Sophos Firewall IPS: Cisco IOS XE WebUI CVE-2023-20198 Authentication Bypass","detail":"Listed in IPS release 18.24.38 (2026-01-14). Older Sophos IPS notes for 2023 are not online. No SID in the notes.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.24.38.html","date":"2026-01-14"},{"title":"Cato IPS: CVE-2023-20198 virtual patch","detail":"Cato IPS virtual patch. Opt-in protection 2023-10-31, global protection 2023-11-01. No rule ID published.","logSource":"Cato Networks IPS events","kind":"vendor-signature","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","dateKind":"checked"}],"detectionRules":[{"id":"sigma-iosxe-webui-syslog","title":"Exploitation Indicators Of CVE-2023-20198","language":"sigma","query":"title: Exploitation Indicators Of CVE-2023-20198\nid: 2ece8816-b7a0-4d9b-b0e8-ae7ad18bc02b\nstatus: test\ndescription: Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.\nreferences:\n    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z\n    - https://www.thestack.technology/security-experts-call-for-incident-response-exercises-after-mass-cisco-device-exploitation/\nauthor: Lars B. P. Frydenskov (Trifork Security)\ndate: 2023-10-20\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - detection.emerging-threats\nlogsource:\n    product: cisco\n    service: syslog\n    definition: 'Requirements: Cisco IOS XE system logs needs to be configured and ingested'\ndetection:\n    keyword_event:\n        - '%WEBUI-6-INSTALL_OPERATION_INFO:'\n        - '%SYS-5-CONFIG_P:'\n        - '%SEC_LOGIN-5-WEBLOGIN_SUCCESS:'\n    keyword_user:\n        - 'cisco_tac_admin'\n        - 'cisco_support'\n        - 'cisco_sys_manager'\n    condition: keyword_event and keyword_user\nfalsepositives:\n    - Rare false positives might occur if there are valid users named \"cisco_tac_admin\" or \"cisco_support\", which are not created by default or CISCO representatives\nlevel: high","logSource":"Cisco IOS XE syslog","author":"Lars B. P. Frydenskov (Trifork Security)","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2023/Exploits/CVE-2023-20198/cisco_syslog_cve_2023_20198_ios_xe_web_ui.yml","sourceDate":"2023-10-20","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"splunk-iosxe-implant-access","title":"Cisco IOS XE Implant Access","language":"spl","query":"| tstats `security_content_summariesonly`\n  count min(_time) as firstTime\n        max(_time) as lastTime\n\nFROM datamodel=Web WHERE\n\nWeb.url=\"*/webui/logoutconfirm.html?logon_hash=*\"\nWeb.http_method=POST\nWeb.status=200\n\nBY Web.http_user_agent Web.status Web.http_method\n   Web.url Web.url_length Web.src Web.dest\n| `drop_dm_object_name(\"Web\")`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `cisco_ios_xe_implant_access_filter`","logSource":"Web data model (Suricata or proxy logs)","author":"Michael Haag, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/cisco_ios_xe_implant_access.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/cisco_ios_xe_implant_access.yml"},{"id":"splunk-iosxe-webui-programmatic-config","title":"Cisco IOS XE WebUI Programmatic Configuration","language":"spl","query":"`cisco_ios`\nfacility=\"SYS\"\nmnemonic=\"CONFIG_P\"\nmessage_text=\"*Configured programmatically by process SEP_webui_wsma_http*\"\n| rex field=_raw \"process\\s(?<process>\\S+)\\sfrom.*as\\s(?<user>\\S+)\\son\\s(?<vty>\\S+)\"\n| eval dest=coalesce(host, dvc, dest, \"unknown\")\n| stats count min(_time) as firstTime\n              max(_time) as lastTime\n              values(process) as process\n              values(vty) as vty\n  by dest user\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `cisco_ios_xe_webui_programmatic_configuration_filter`","logSource":"Cisco IOS syslog","author":"Nasreddine Bencherchali","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml","sourceDate":"2026-09-08","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml"},{"id":"et-badcandy-implant-checkin","title":"ET MALWARE BadCandy Cisco IOS XE Implant Check-in","language":"suricata","query":"alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET MALWARE BadCandy Cisco IOS XE Implant Check-in\"; flow:established,to_server; urilen:38; http.method; content:\"POST\"; http.uri; content:\"/webui/logoutconfirm.html?logon_hash=1\"; fast_pattern; threshold:type limit,seconds 300,count 1,track by_src; reference:url,blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/; reference:cve,2023-20198; classtype:trojan-activity; sid:2048584; rev:3; metadata:affected_product Cisco_IOS, attack_target Web_Server, created_at 2023_10_17, cve CVE_2023_20198, deployment Perimeter, deployment Internet, deployment SSLDecrypt, former_category EXPLOIT, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_10_21, reviewed_at 2024_01_26; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-malware.rules","sourceDate":"2026-10-21","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","tested":"untested"},{"id":"et-iosxe-webui-command-injection-20273","title":"ET EXPLOIT Cisco IOS XE Web UI Command Injection Vulnerability (CVE-2023-20273)","language":"suricata","query":"alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET EXPLOIT Cisco IOS XE Web UI Command Injection Vulnerability (CVE-2023-20273)\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"/webui/rest/softwareMgmt/installAdd\"; startswith; nocase; fast_pattern; http.cookie; content:\"Auth=\"; startswith; http.header_names; to_lowercase; content:\"|0d 0a|x-csrf-token|0d 0a|\"; nocase; http.request_body; content:\"|22|ipaddress|22|\"; nocase; content:\"|22|\"; within:5; content:\"|3a|\"; within:5; content:\"|3a|\"; within:5; content:\"|3a|\"; within:5; pcre:\"/^.{0,5}(?:[\\x60\\x3b\\x7c\\x26]|%60|%3b|%7c|%26|(?:[\\x3c\\x3e\\x24]|%3c|%3e|%24)(?:\\x28|%28))/R\"; reference:url,blog.leakix.net/2023/10/cisco-root-privesc/; reference:url,twitter.com/joel_land/status/1719708750741639539; reference:url,sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z; reference:cve,2023-20273; classtype:attempted-admin; sid:2049007; rev:2; metadata:affected_product Cisco_IOS, attack_target Networking_Equipment, created_at 2023_11_01, cve CVE_2023_20273, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Critical, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_27, reviewed_at 2023_11_01, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","sourceDate":"2024-04-27","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Needs decrypted HTTP to the device web UI.","tested":"untested"},{"id":"v2s-kql-iosxe-webui-syslog","title":"Cisco IOS XE web UI compromise messages (Sentinel Syslog)","language":"kql","query":"Syslog\n| where TimeGenerated > ago(30d)\n| where SyslogMessage has_any (\"%SYS-5-CONFIG_P\", \"%SEC_LOGIN-5-WEBLOGIN_SUCCESS\", \"%WEBUI-6-INSTALL_OPERATION_INFO\")\n| where SyslogMessage has_any (\"cisco_tac_admin\", \"cisco_support\") or SyslogMessage has \"INSTALL_OPERATION_INFO\"\n| project TimeGenerated, HostName, SyslogMessage","logSource":"Cisco IOS XE syslog in Microsoft Sentinel (Syslog table)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","sourceDate":"2023-10-16","license":"CC0 1.0","origin":"vuln2shell","notes":"Messages and usernames from Cisco's advisory. Any unknown local user in these messages counts, not just the two named.","tested":"untested"},{"id":"v2s-logscale-iosxe-webui-syslog","title":"Cisco IOS XE web UI compromise messages (LogScale)","language":"logscale","query":"/%(SYS-5-CONFIG_P|SEC_LOGIN-5-WEBLOGIN_SUCCESS|WEBUI-6-INSTALL_OPERATION_INFO)/\n| /cisco_tac_admin|cisco_support|INSTALL_OPERATION_INFO/\n| groupBy([@host], function=count())","logSource":"Cisco IOS XE syslog ingested into LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","sourceDate":"2023-10-16","license":"CC0 1.0","origin":"vuln2shell","notes":"Same logic as the KQL version.","tested":"untested"}],"detectionLinks":[{"title":"Cisco PSIRT advisory cisco-sa-iosxe-webui-privesc-j22SaA4z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","author":"Cisco PSIRT","date":"2023-10-16","note":"Syslog indicators and implant check."},{"title":"Cisco Talos: Active exploitation of Cisco IOS XE Software","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","author":"Cisco Talos","date":"2023-10-16","note":"Lists Snort SIDs 3:50118, 3:62527 to 3:62529 and 3:62541 to 3:62542. The Talos rule text was not copied; get it from Snort rulesets under their own licence."},{"title":"Splunk: Cisco IOS XE detections (log clearing, guestshell, VTY access-class)","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/application/cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml","author":"Splunk Threat Research Team"}],"retrohunt":{"summary":"Search device syslog back to 18 Sep 2023 for Web UI logins and config changes by unknown users such as cisco_tac_admin or cisco_support, check for unknown local accounts, and run Cisco's implant check.","lookback":{"from":"2023-09-18","basis":"first-exploitation","rationale":"Cisco Talos says related activity began as early as 18 Sep 2023. Accounts created then survive reboots, so check current config even if logs do not go back that far.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]},"logSources":[{"name":"IOS XE syslog (central collector)","why":"Shows Web UI logins, programmatic config and install operations.","required":true},{"name":"Running and startup configuration","why":"Unknown local users persist after reboot.","required":true},{"name":"Web proxy or IDS logs in front of the device","why":"Show implant check-ins and probing of /webui.","required":false}],"steps":[{"title":"Search syslog for the Cisco indicators","detail":"Look for %SYS-5-CONFIG_P and %SEC_LOGIN-5-WEBLOGIN_SUCCESS with unknown usernames such as cisco_tac_admin or cisco_support, and %WEBUI-6-INSTALL_OPERATION_INFO with unknown file names.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}]},{"title":"Review local accounts on every device with the HTTP server on","detail":"List username entries and compare with your approved list. Reboot clears the implant but not the accounts.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]},{"title":"Run Cisco's implant check","detail":"Cisco documents an HTTP request to /webui/logoutconfirm.html?logon_hash=1; a hexadecimal string reply means a known implant. Later variants need the Authorization header check Cisco added.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]}],"queries":[{"id":"v2s-rh-spl-iosxe-webui","title":"IOS XE Web UI compromise messages since 18 Sep 2023","language":"spl","query":"index=* (sourcetype=cisco:ios OR sourcetype=syslog) earliest=\"09/18/2023:00:00:00\"\n(\"%SYS-5-CONFIG_P\" OR \"%SEC_LOGIN-5-WEBLOGIN_SUCCESS\" OR \"%WEBUI-6-INSTALL_OPERATION_INFO\")\n| rex \"(?i)by (?<user>\\S+)\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(user) as users by host\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Cisco IOS XE syslog in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","sourceDate":"2023-10-16","license":"CC0 1.0","origin":"vuln2shell","notes":"Review every username in users, not only cisco_tac_admin and cisco_support.","tested":"untested","timeRange":"From 2023-09-18"},{"id":"v2s-rh-kql-iosxe-webui","title":"IOS XE Web UI compromise messages since 18 Sep 2023","language":"kql","query":"Syslog\n| where TimeGenerated >= datetime(2023-09-18)\n| where SyslogMessage has_any (\"%SYS-5-CONFIG_P\", \"%SEC_LOGIN-5-WEBLOGIN_SUCCESS\", \"%WEBUI-6-INSTALL_OPERATION_INFO\")\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Samples = make_set(SyslogMessage, 5) by HostName","logSource":"Cisco IOS XE syslog in Microsoft Sentinel (Syslog table)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","sourceDate":"2023-10-16","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2023-09-18, limited by retention"},{"id":"v2s-rh-logscale-iosxe-webui","title":"IOS XE Web UI compromise messages","language":"logscale","query":"// Set the time picker to start 2023-09-18\n/%(SYS-5-CONFIG_P|SEC_LOGIN-5-WEBLOGIN_SUCCESS|WEBUI-6-INSTALL_OPERATION_INFO)/\n| groupBy([#host], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"Cisco IOS XE syslog in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","sourceDate":"2023-10-16","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2023-09-18"}],"thirdPartyQueries":[{"title":"Cisco IOS XE Web UI syslog rule","url":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2023/Exploits/CVE-2023-20198/cisco_syslog_cve_2023_20198_ios_xe_web_ui.yml","author":"SigmaHQ","date":null,"language":"sigma","license":"DRL 1.1","origin":"community","note":"Same messages as a Sigma rule."}],"artefacts":[{"kind":"account","value":"cisco_tac_admin, cisco_support","detail":"Local users created by the attacker.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"},{"kind":"device-log","value":"%WEBUI-6-INSTALL_OPERATION_INFO with an unknown file name","detail":"Implant install.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"},{"kind":"web-log","value":"Requests to /webui/logoutconfirm.html with logon_hash","detail":"Implant check-in or check.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"}],"iocs":[{"type":"username","value":"cisco_tac_admin","context":"Attacker-created local user.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"},{"type":"username","value":"cisco_support","context":"Attacker-created local user.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"}],"hitMeaning":[{"level":"attempt","detail":"Probing of /webui with no new users or config changes."},{"level":"likely-compromise","detail":"A Web UI login or config change by an unknown user."},{"level":"confirmed-compromise","detail":"An unknown local account in the config, or a positive implant check."}],"nextSteps":[{"title":"Remove accounts and upgrade","detail":"Delete unknown users, upgrade to a fixed release, and turn off the HTTP server on internet-facing devices.","links":[{"label":"Cisco advisory","href":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z"}]},{"title":"Review what the account did","detail":"Check config diffs and AAA logs from the first unknown login onward."}],"limits":["The implant is in memory and is cleared by a reboot, so a negative check after reboot does not clear the device.","Devices that never sent syslog off-box have no history."],"sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"Cisco IOS XE with the Web UI enabled (ip http server or ip http secure-server) is in scope until a first-fixed release such as 17.9.4a, 17.6.6a, 17.3.8a, or 16.12.10a (Catalyst 3650/3850) or the listed SMUs. Cisco confirmed ASA, FTD, ISE, classic IOS, IOS XE prior to Release 16, and NX-OS are not affected.","checks":[{"id":"v2s-aia-cisco-ios-xe-webui-version-1","kind":"version","title":"Compare show version to the first-fixed trains","detail":"Cisco advisory first-fixed table: 17.9 -> 17.9.4a; 17.6 -> 17.6.6a; 17.3 -> 17.3.8a; 16.12 (Catalyst 3650 and 3850 only) -> 16.12.10a. SMUs: 17.9.4 and 17.6.5. Use Cisco Software Checker for platform-specific coverage. Advisory last updated 2023-11-01.","command":"show version | include Cisco IOS XE Software","affectedMeans":"IOS XE Release 16 or later, below the first-fixed release for that train, if the HTTP Server feature is enabled (next check).","fixedMeans":"Running 17.9.4a, 17.6.6a, 17.3.8a, 16.12.10a (3650/3850), a later fixed release, or the CSCwh87343 SMU Cisco lists for 17.9.4 / 17.6.5.","sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}]},{"id":"v2s-aia-cisco-ios-xe-webui-config-2","kind":"config","title":"HTTP Server / Web UI feature enabled","detail":"Cisco: these vulnerabilities affect IOS XE if the web UI feature is enabled through ip http server or ip http secure-server. If ip http server is present and the config also contains ip http active-session-modules none, they are not exploitable over HTTP. If ip http secure-server is present and ip http secure-active-session-modules none is present, they are not exploitable over HTTPS. Presence of either server command means the HTTP Server feature is on.","command":"show running-config | include ip http server|secure|active","affectedMeans":"ip http server and/or ip http secure-server is present, the matching active-session-modules none line is absent, and show version is below the first-fixed release for that train (17.9.4a, 17.6.6a, 17.3.8a, 16.12.10a on Catalyst 3650/3850, or the CSCwh87343 SMU on 17.9.4 / 17.6.5).","fixedMeans":"Neither ip http server nor ip http secure-server is present (Cisco: the vulnerabilities are not exploitable), or each enabled transport also has the matching active-session-modules none line (not exploitable over that transport), or the device is on a first-fixed release / SMU. Cisco-stated not-affected products: ASA, FTD, ISE, classic IOS, IOS XE prior to Release 16, NX-OS.","notes":"Cisco's 'not exploitable' wording is about the HTTP Server attack vector, not a substitute for the version table when the Web UI is on.","sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}]},{"id":"v2s-aia-cisco-ios-xe-webui-exposure-3","kind":"exposure","title":"Internet-facing or untrusted-network reachability of the Web UI","detail":"Cisco strongly recommends disabling the HTTP Server feature on all internet-facing systems or restricting it to trusted source addresses. Inventory whether TCP 80/443 to the device management addresses is reachable from untrusted networks. Do not send exploit traffic.","command":"show ip interface brief; show running-config | include ip http access-class|ip http server|ip http secure-server","affectedMeans":"HTTP Server is enabled, the device is below a first-fixed release, and the Web UI is reachable from the internet or another untrusted network without an HTTP access-class limited to trusted sources.","fixedMeans":"No untrusted path to the Web UI, or HTTP Server is disabled and the running-configuration has been saved, or the device is on 17.9.4a / 17.6.6a / 17.3.8a / 16.12.10a (3650/3850) or a listed SMU.","notes":"Censys and Shadowserver counts on the catalog page are global implant scans, not an inventory query for your ranges.","sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}]},{"id":"v2s-aia-cisco-ios-xe-webui-exposure-4","kind":"exposure","title":"Scope any internet host search to your ranges","detail":"The catalog page has no vendor-published Shodan product string for IOS XE Web UI. If you already search Shodan or Censys for your own management addresses, add net:<your-range> or org:\"<your org>\". Censys and Shadowserver counts on this page are global implant scans, not your inventory. Do not send implant-check traffic as an exposure check.","command":"Add net:<your-range> or org:\"<your org>\" to any Shodan or Censys query you already run for your IOS XE management addresses","affectedMeans":"A host in your net or org that you already identify as an IOS XE management address, with HTTP Server enabled and below a first-fixed release.","fixedMeans":"No matching management addresses in your scoped search, or every hit is confirmed disabled/restricted and on a first-fixed release or listed SMU.","sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}]}],"limits":["show version alone is not enough; the HTTP Server feature must also be inventoried.","Cisco Software Checker is required for platform-specific coverage beyond the four first-fixed trains listed on 2023-11-01.","A reboot that clears BadCandy does not change the version table or remove local accounts.","No sourced Shodan product query is published on the catalog page; do not invent one."],"sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Cisco says there is no workaround that remediates the code flaw. Disabling or restricting the HTTP Server feature removes the attack vector until you upgrade.","items":[{"title":"Disable the HTTP Server feature until upgraded","detail":"Cisco Workarounds section: there are no workarounds that address these vulnerabilities. Disabling the HTTP Server feature eliminates the attack vector and may be a suitable mitigation until affected devices can be upgraded. Use no ip http server and/or no ip http secure-server in global configuration mode. If both are in use, both commands are required. After changes, Cisco: copy running-configuration startup-configuration so a reload does not revert them. Recommendations: if you do not run services that require HTTP/HTTPS (Cisco example: eWLC), disable the feature.","limits":"Does not remove attacker-created local accounts or a BadCandy implant already written. Breaks any service that needs the Web UI or HTTP Server. Not a software fix; still upgrade to 17.9.4a, 17.6.6a, 17.3.8a, 16.12.10a (3650/3850), or a listed SMU.","verify":"show running-config | include ip http server|secure|active  # neither ip http server nor ip http secure-server should appear; then show startup-config | include ip http server|secure-server","source":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}},{"title":"Restrict HTTP Server access to trusted networks with an access-class","detail":"Cisco: limiting access to the HTTP Server to trusted networks will limit exposure. Example they published: ip http access-class 75; ip http secure-server; access-list 75 permit 192.168.0.0 0.0.0.255; access-list 75 deny any. On newer IOS XE, use ip http access-class ipv4 75. Advisory revision 1.3 (2023-10-20) added this mitigation. Cisco assesses with high confidence that access lists applied to the HTTP Server feature to restrict untrusted hosts are an effective mitigation.","limits":"Does not patch the bug. Cisco: review the controls because production services can break. Replace 192.168.0.0/24 with your trusted management range; do not copy the example prefix as if it were yours. Does not remove existing local users or the implant.","verify":"show running-config | include ip http access-class|access-list 75  # access-class present and the ACL permits only your management nets","source":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Disable the Web UI on internet-facing devices, then hunt cisco_tac_admin / cisco_support and the BadCandy implant. A reboot clears the non-persistent implant but not the accounts.","containment":[{"title":"Close the Web UI attack vector on internet-facing devices","detail":"Cisco: disable the HTTP Server feature or restrict it to trusted source addresses. Save with copy running-configuration startup-configuration.","sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}]},{"title":"Remove unknown local users before or after reboot","detail":"Talos: the implant is not persistent and a reboot removes it; newly created local users remain and have level 15 privileges. Compare username entries to your approved list and remove unknowns. Do not treat a post-reboot clean implant check as recovery.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]},{"title":"Isolate a device with unknown local users or a positive implant check","detail":"Take the management plane off untrusted networks until accounts are removed and a fixed release is installed.","generic":true}],"rotate":[{"item":"Attacker-created local privilege-15 accounts (examples cisco_tac_admin, cisco_support, cisco_sys_manager, plus any unknown local user)","reason":"CVE-2023-20198 is used to create a local privilege-15 user. Talos observed those three names in creation or cleanup. Any unknown local user counts.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"}]},{"item":"Local enable secret / local user passwords that a privilege-15 account can change","reason":"A privilege-15 local user has full administrator access to the device (Talos). If compromise is suspected, reset local authentication secrets.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]},{"item":"Secrets visible in running-config (TACACS/RADIUS keys, SNMP, VPN PSKs, certificates)","reason":"Privilege 15 can show running-config. Cisco did not publish a named rotate-secrets list; treat this as standard IR after admin-level compromise.","generic":true}],"persistence":[{"kind":"account","value":"cisco_tac_admin","detail":"Talos: authorized-looking local user created from 5.149.249.74 as early as 2023-09-18. Activity of this name ended 2023-10-01. Level 15. Survives reboot.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"},{"kind":"account","value":"cisco_support","detail":"Talos: second cluster from 2023-10-12 created this local user from 154.53.56.231, then deployed BadCandy. Level 15. Survives reboot.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"},{"kind":"account","value":"cisco_sys_manager","detail":"Talos observed cleanup: no username cisco_sys_manager (with no username cisco_support and no username cisco_tac_admin, plus clear logging).","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"},{"kind":"path","value":"/usr/binos/conf/nginx-conf/cisco_service.conf","detail":"Talos: BadCandy is a Lua implant saved as this nginx config. It defines a new web endpoint used to interact with the implant. Not persistent across reboot. In at least one case the web server was not restarted so the implant never became active.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"},{"kind":"webshell","value":"BadCandy (Lua, named by Talos 2023-11-01)","detail":"29-line Lua web shell. Later variants check Authorization (from about 2023-10-20) and X-Csrf-Token (third version, Talos 2023-11-02). Reboot clears the implant, not the accounts.","sourceUrl":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","sourceDate":"2023-10-16"}],"evidence":[{"title":"Running and startup configuration before any cleanup","detail":"Capture show running-config and show startup-config (or an archive) before deleting users or disabling HTTP. Unknown username entries persist after reboot and are the durable IOC.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]},{"title":"Syslog for Web UI login, programmatic config, and install operations","detail":"Cisco: %SYS-5-CONFIG_P Configured programmatically by process SEP_webui_wsma_http; %SEC_LOGIN-5-WEBLOGIN_SUCCESS with unknown user; %WEBUI-6-INSTALL_OPERATION_INFO Install Operation: ADD filename. Hunt any unknown username, not only the named examples. Lookback from 2023-09-18 if logs exist (Talos first related activity).","sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"},{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]},{"title":"Cisco implant-presence check (IR only, not inventory)","detail":"Cisco and Talos published an implant check to run against your own device. Follow the Cisco advisory or the Talos post. A negative result after reboot does not clear the device. Do not use this as an Am I affected version check.","sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"},{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]},{"title":"Proxy or IDS logs for /webui/logoutconfirm.html?logon_hash","detail":"Catalog and Talos: implant check-in or check. Preserve before rebuild.","sources":[{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}]},{"title":"Standard device IR artifacts","detail":"AAA/accounting if configured, config diffs from the first unknown login, crashinfo, and off-box syslog. Devices that never sent syslog off-box have no history (catalog limit).","generic":true}],"sources":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","publisher":"Cisco"},{"url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","publisher":"Cisco Talos"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Cato Networks","title":"Rapid CVE Mitigation by Cato Security Research","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","cve":"CVE-2023-20198","dateKind":"checked"},{"vendor":"Check Point","title":"CPAI-2023-0927 Cisco IOS XE Authentication Bypass (CVE-2023-20198)","url":"https://advisories.checkpoint.com/defense/advisories/public/2023/cpai-2023-0927.html","date":"2023-10-18","cve":"CVE-2023-20198"},{"vendor":"Cisco Talos","title":"Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","cve":"CVE-2023-20198"},{"vendor":"Cisco Talos","title":"Multiple vulnerabilities in Cisco IOS XE Software Web UI feature","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","cve":"CVE-2023-20198, CVE-2023-20273"},{"vendor":"Citrix","title":"NetScaler signature update version 117","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-117.html","date":"2026-10-23","cve":"CVE-2023-20198","dateKind":"checked"},{"vendor":"F5","title":"F5 Distributed Cloud attack signatures reference","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2023-11-13","cve":"CVE-2023-20198"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2023-20198","url":"https://www.fortiguard.com/search?q=CVE-2023-20198&engine=1","date":"2023-10-31","cve":"CVE-2023-20198"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2023-20273","url":"https://www.fortiguard.com/search?q=CVE-2023-20273&engine=1","date":"2023-11-15","cve":"CVE-2023-20273"},{"vendor":"Fortinet","title":"FortiGuard Outbreak Alert: Cisco IOS XE Web UI Vulnerability","url":"https://www.fortiguard.com/outbreak-alert/cisco-ios-xe-web-ui-vulnerability","date":"2026-10-23","cve":"CVE-2023-20198, CVE-2023-20273","dateKind":"checked"},{"vendor":"Juniper","title":"HTTP:CTS:CISCO-IOS-XE-EOP","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:CISCO-IOS-XE-EOP.html","date":"2023-10-26","cve":"CVE-2023-20198, CVE-2023-20273"},{"vendor":"Juniper","title":"HTTP:CISCO:IOS-WEB-AUTH-BYPASS","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CISCO:IOS-WEB-AUTH-BYPASS.html","date":"2024-01-08","cve":"CVE-2023-20198, CVE-2023-20273"},{"vendor":"Palo Alto Networks","title":"Threat Brief: Cisco IOS XE Web UI privilege escalation (CVE-2023-20198)","url":"https://unit42.paloaltonetworks.com/threat-brief-cve-2023-20198-cisco-ios-xe/","date":"2023-10-18","cve":"CVE-2023-20198"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.24.38","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.24.38.html","date":"2026-01-14","cve":"CVE-2023-20198"}],"coverage":[{"title":"Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature","publisher":"Cisco","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","date":"2023-10-16","type":"vendor"},{"title":"Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities","publisher":"Cisco Talos","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","date":"2023-10-16","type":"research"},{"title":"Cisco IOS XE CVE-2023-20198: Deep Dive and POC","publisher":"Horizon3","url":"https://horizon3.ai/attack-research/attack-blogs/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/","date":"2023-10-30","type":"research"}],"posts":[],"research":[{"title":"Cisco PSIRT advisory","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","authors":"Cisco PSIRT","date":"2023-10-16"},{"title":"Cisco Talos active exploitation analysis","url":"https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/","authors":"Cisco Talos","date":"2023-10-16"},{"title":"NVD CVE-2023-20198","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20198","authors":"NVD","date":"2023-10-16"},{"title":"Horizon3 deep dive","url":"https://horizon3.ai/attack-research/attack-blogs/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/","authors":"Horizon3","date":"2023-10-30"}],"impact":{"kind":"single-product","product":"Cisco IOS XE Software (Web UI enabled)","versions":[{"version":"IOS XE 17.9 train","status":"affected","versions":"17.9.4a","vendorStatement":{"date":"2023-10-16","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","quote":"Cisco IOS XE Software Release Train 17.9 first fixed release 17.9.4a (available)."}},{"version":"IOS XE 17.6 train","status":"affected","versions":"17.6.6a","vendorStatement":{"date":"2023-10-16","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","quote":"Cisco IOS XE Software Release Train 17.6 first fixed release 17.6.6a (available)."}},{"version":"IOS XE 17.3 train","status":"affected","versions":"17.3.8a","vendorStatement":{"date":"2023-10-16","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","quote":"Cisco IOS XE Software Release Train 17.3 first fixed release 17.3.8a (available)."}},{"version":"IOS XE 16.12 (Catalyst 3650/3850)","status":"affected","versions":"16.12.10a","vendorStatement":{"date":"2023-10-16","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","quote":"16.12 (Catalyst 3650 and 3850 only) first fixed release 16.12.10a (available)."}},{"version":"IOS XE prior to Release 16 / IOS / ASA / FTD / ISE / NX-OS","status":"vendor-stated-not-affected","vendorStatement":{"date":"2023-10-16","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z","quote":"Cisco has confirmed that these vulnerabilities do not affect ASA Software, FTD Software, ISE, IOS Software, IOS XE Software prior to Release 16, or NX-OS Software."}}]},"pocs":[],"pocEmptyState":"Horizon3 published a deep dive and PoC discussion on 30 Oct 2023. Cisco published implant-presence check commands rather than an exploit PoC. No separate public exploit repository is indexed here.","_feed":{"page":"https://vuln2shell.com/vulns/cisco-ios-xe-webui","json":"https://vuln2shell.com/vulns/cisco-ios-xe-webui.json","iocsCsv":"https://vuln2shell.com/vulns/cisco-ios-xe-webui/iocs.csv","stix":"https://vuln2shell.com/vulns/cisco-ios-xe-webui/stix.json"}}