Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-20198 Details

Description

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198 CISA-ADPUS Government Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z CVEMitigationVendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z [email protected]MitigationVendor Advisory

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability NameDate AddedDue DateRequired Action
Cisco IOS XE Web UI Privilege Escalation VulnerabilityOct 16, 2023Oct 20, 2023Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

Weakness Enumeration

CWE-IDCWE NameSource
NVD-CWE-OtherWeakness Not in a Standard CWE Category[email protected]
CWE-420Unprotected Alternate Channel[email protected]

Affected Products

ProductVersions
rockwellautomation allen-bradley stratix 5200 firmware
< 17.12.02

CPE

  • cpe:2.3:o:rockwellautomation:allen-bradley_stratix_5200_firmware:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
rockwellautomation allen-bradley stratix 5200
All versions

CPE

  • cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5200:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
rockwellautomation allen-bradley stratix 5800 firmware
< 17.12.02

CPE

  • cpe:2.3:o:rockwellautomation:allen-bradley_stratix_5800_firmware:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
rockwellautomation allen-bradley stratix 5800
All versions

CPE

  • cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5800:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
cisco ios xe
>= 16.12, < 16.12.10a
>= 17.3, < 17.3.8a
>= 17.6, < 17.6.6a
>= 17.9, < 17.9.4a

CPE

  • cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

20 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-20198
NVD Published Date:
Oct 16, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-20198 Details - Not Deferred