Cybersecurity Briefing — Cisco IOS XE Web UI zero-day CVE-2023-20198
Cisco warned on 16 October 2023 that CVE-2023-20198 was being exploited on IOS XE devices with the Web UI enabled, allowing unauthenticated remote code execution and full device takeover until emergency patches shipped later that month.
On 16 October 2023 Cisco disclosed CVE-2023-20198, a zero-day in the IOS XE Web UI feature that allowed unauthenticated attackers to create privileged accounts on exposed devices. Active exploitation was observed in the wild against internet-facing routers and switches.
Cisco advised administrators to disable the HTTP Server feature, restrict management access, and monitor for rogue accounts while fixes were developed. Subsequent software updates in late October addressed the vulnerability, but operators were urged to audit logs for compromise and rotate credentials.
- Cisco security advisory details affected releases, mitigation steps, and patch availability timelines.
- Cisco PSIRT blog describes observed exploitation activity and indicators defenders should review.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook — Zeph Tech
Use Zeph Tech research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.