Vulnerability Details : CVE-2023-20198

Public exploit exists!
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
Published 2023-10-16 16:15:10
Updated 2024-06-17 13:31:45
Source Cisco Systems, Inc.
View at NVD,   CVE.org

Products affected by CVE-2023-20198

CVE-2023-20198 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Cisco IOS XE Web UI Privilege Escalation Vulnerability
CISA required action:
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and
CISA description:
Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.
Notes:
https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html; https://nvd.nist.gov/vuln/detail/CVE-2023-20198
Added on 2023-10-16 Action due date 2023-10-20

Exploit prediction scoring system (EPSS) score for CVE-2023-20198

EPSS FAQ
88.34%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2023-20198

  • Cisco IOX XE Unauthenticated RCE Chain
    Disclosure Date: 2023-10-16
    First seen: 2023-11-09
    exploit/linux/misc/cisco_ios_xe_rce
    This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute a payload with root privileges. The vulnerable IOS XE versions are: 16.1.1, 16.1.2, 16.1.
  • Cisco IOX XE unauthenticated Command Line Interface (CLI) execution
    Disclosure Date: 2023-10-16
    First seen: 2023-11-09
    auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198
    This module leverages CVE-2023-20198 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute arbitrary CLI commands with privilege level 15. You must specify the IOS command mode to execute a CLI command in. Valid mo
  • Cisco IOX XE unauthenticated OS command execution
    Disclosure Date: 2023-10-16
    First seen: 2023-11-09
    auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273
    This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute arbitrary OS commands with root privileges. This module leverages CVE-2023-20198 to create a new ad

CVSS scores for CVE-2023-20198

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
10.0
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3.9
6.0
 NIST
10.0
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3.9
6.0
 Cisco Systems, Inc.

CWE ids for CVE-2023-20198

  • The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
    Assigned by: ykramarz@cisco.com (Secondary)

References for CVE-2023-20198

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close