CVE-2023-20198

This is a weakness in a router/switch web feature. If someone can reach it over the network, they can get in without a login and create their own username/password. That can then let them escalate to full control and leave behind a persistent “implant” for future access.

This matters if your business uses or manages devices running Cisco IOS XE Software (and if you have Allen-Bradley Stratix 5200 or 5800 firmware in the affected range). It does not require a login or user interaction, so the main question is exposure: it’s a risk when the IOS XE Web UI is reachable from the internet or from untrusted networks. If the web UI is not reachable externally, the risk is much lower.

This is RED because CISA lists it as a known, actively exploited vulnerability in real-world conditions. Cisco also describes observed exploitation of the web UI feature, and the issue enables follow-on compromise after creating a local user. Treat it as an immediate remediation priority if any external or untrusted access to the Web UI is possible.

How to confirm exposure

• Identify all network devices in your environment running Cisco IOS XE Software (and any Allen-Bradley Stratix 5200 / Stratix 5800 firmware).
• For each device, verify whether the Web UI feature is enabled and exposed:
  • Check whether the HTTP server and/or HTTPS server components are enabled.
  • Confirm whether those services are reachable from the internet or any untrusted network segment (including via port forwarding, NAT, or “guest/partner” networks).

Immediate mitigation (if exposed)

• Disable the Web UI HTTP/HTTPS servers immediately using the vendor commands:
  • no ip http server
  • no ip http secure-server
• This directly reduces the attacker’s ability to reach the vulnerable web feature.

Upgrade / fixed versions

• Plan an upgrade to the fixed releases:
  • Cisco IOS XE Software: fixed in 16.12.10a
  • Allen-Bradley Stratix 5200 firmware: fixed in 17.12.02
  • Allen-Bradley Stratix 5800 firmware: fixed in 17.12.02
• Apply the upgrade in accordance with your device maintenance window and vendor guidance for your specific platform.

If compromise is suspected

• Cisco’s advisory and CISA guidance (KEV) indicate that you should determine whether the system may have been compromised.
• If you find positive indicators, follow vendor instructions and report positive findings to CISA.

What to monitor after changes

• Look for unusual authentication events or newly created local user accounts.
• Check for signs of unauthorized access patterns to the device management interface.
• Monitor for configuration changes consistent with web UI-based account creation and follow-on actions.

KEV timing

• KEV entry added: 2023-10-16
• CISA remediation due date listed for the required action: 2023-10-20

Severity: critical (CVSS 10 reported).
Weakness/Type: CWE-420 (information on the finding indicates the attacker can create a local user/password without authentication).
Attack vector & trigger: network-reachable Cisco IOS XE web UI feature; authentication is not required and no user interaction is required.
Observed exploitation: listed in CISA KEV (added 2023-10-16) and Cisco reports ongoing investigation into observed exploitation of the web UI feature; the capability includes creating local credentials enabling privilege escalation and implant deployment.
Exploit maturity: public proof-of-concept exists, and KEV indicates real-world exploitation (so this should be treated as actively exploited, not theoretical).
EPSS/prediction: a high EPSS prediction is noted in the findings, but KEV real-world exploitation is the controlling factor for urgency in this case.