Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cisco confirmed active exploitation of CVE-2023-20198, a critical vulnerability in the Web UI feature of Cisco IOS XE. The original “unpatched” headline described the October 16, 2023 disclosure; Cisco later published fixed software. For operators, the practical priorities are to check whether the Web UI was enabled and reachable, install the correct current release for the device, and investigate for signs of compromise.
What the Cisco IOS XE vulnerability did
CVE-2023-20198 is an unauthenticated privilege-escalation vulnerability in the Cisco IOS XE Web UI. Cisco assigned it a CVSS 3.1 base score of 10.0. The affected condition involves the Web UI with either ip http server or ip http secure-server configured. Cisco and Talos described exposure when the interface was reachable from the internet or another untrusted network. Merely owning a Cisco device does not establish that it was vulnerable; the product, software, configuration, and network reachability matter. Cisco’s advisory identifies product applicability and configuration details.
Cisco said it was aware of active exploitation when it published its advisory on October 16, 2023. The original headline’s “unpatched” wording belongs to that disclosure window, not to the current state of Cisco’s response: later revisions listed fixed software releases. Treat those older entries as historical guidance and verify the correct current release for the specific platform.
How the attacks worked
The observed intrusion chain involved two distinct vulnerabilities, not one. Attackers used CVE-2023-20198 to create a local account with privilege level 15. They then used CVE-2023-20273, a separate Web UI vulnerability, to gain root privileges and write an implant. Cisco assigned CVE-2023-20273 a CVSS base score of 7.2. Talos later identified the Lua-based web shell as BadCandy. The two CVEs should not be conflated: the 10.0 score applies to CVE-2023-20198.
#1 Best Overall
- Dual Gigabit Ethernet Ports: Features 2 RJ45 10/100/1000 LAN/WAN ports for high-speed network connectivity and flexible deployment options
- Enhanced High-Speed WAN Interface Card Slots: Equipped with 2 EHWIC slots for modular expansion and customization of network services
- Security Feature Set: Includes SEC feature set with embedded hardware encryption acceleration and advanced security services for comprehensive network protection
- Doublewide EWIC Slot: Provides 1 doublewide EWIC slot that occupies both standard EHWIC slots when used, offering flexibility for high-density interface requirements
- USB Connectivity: Includes 1 USB port for external storage, configuration management, and additional connectivity options
Cisco Talos reported that it found early evidence on September 28, 2023, and assessed that related malicious activity may have begun as early as September 18. It described a second activity cluster detected on October 12. In a November 1 update, Talos noted increased exploitation attempts after proof-of-concept exploits were published; that was a qualitative observation, not a published count. The incident timeline and threat observations are in Cisco Talos’s analysis.
Check whether your IOS XE device was exposed
Start with the device’s actual software and running configuration, then determine whether its management interface could be reached by untrusted systems. Cisco’s advisory says the relevant HTTP or HTTPS path is not exploitable when the corresponding active-session module is set to none. Use the complete advisory for the applicable commands and interpretation rather than relying on a single configuration line in isolation.
Rank #2
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
- Confirm the device runs an affected Cisco IOS XE release; Cisco lists ASA, FTD, ISE, IOS, NX-OS, and IOS XE releases before 16 as not affected by these vulnerabilities.
- Inspect the running configuration for
ip http serverandip http secure-server. - Establish whether the Web UI was reachable from the internet or another untrusted network, including through management networks, firewalls, or access-control rules.
- Check the relevant active-session module settings. Cisco states that setting the corresponding module to
nonemakes that HTTP or HTTPS path not exploitable.
Exposure is a configuration-and-reachability question, not simply a question of whether an IOS XE device is present in the network.
Reduce exposure and install the applicable fix
Disable the Web UI if it is not needed
Cisco’s interim mitigation was to disable the HTTP Server feature on internet-facing systems or restrict access to trusted source addresses. If both HTTP and HTTPS server features are in use, Cisco says both commands are needed to disable them:
Rank #3
- Aggregate Throughput: 100 Mbps to 300 Mbps
- Total onboard WAN or LAN 10/100/1000 ports: 3
- RJ-45-based ports: 2
- SFP-based ports: 2
- Enhanced service-module (SM-X) slot: 1
no ip http serverno ip http secure-server
Evaluate the effect on the environment before making configuration changes: disabling the service or restricting access can disrupt production functionality. If the management UI must remain available, limit it to trusted source addresses and networks, then save the running configuration after changes. Follow the full Cisco advisory for operational details.
Use Cisco’s platform-specific software guidance
Cisco later listed fixed releases including IOS XE 17.9.4a, 17.6.6a, 17.3.8a, and 16.12.10a for Catalyst 3650 and 3850. These are entries from the advisory, not a universal upgrade recommendation or assurance that a release is current for every device. Use Cisco’s Software Checker and the current advisory to identify advisories affecting the exact release and the earliest fixed release for the platform. Plan and validate the upgrade against the device’s supported release path.
Rank #4
Check for compromise as well as patching
Installing fixed software addresses the vulnerability going forward; by itself, it does not establish whether an attacker used it earlier or left persistence behind. Cisco advises reviewing logs for unexpected local usernames and suspicious Web UI install operations. The advisory also contains a Talos implant-check command and Snort rule IDs for attempted initial access, implant injection, and implant interaction. Because indicators and guidance can change, consult the complete current advisory before performing checks.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteInvestigate unexplained privilege-level-15 accounts, suspicious management activity, and evidence associated with the implant. Preserve relevant logs and configuration details while following your organization’s incident-response process. If the device was exposed during the exploitation window or evidence is found, involve the network security or incident-response team; do not treat an upgrade alone as proof that the device is clean.
Quick Recap
Best Value
- Enjoy the benefits of Wireless-N in your home--ideal for wireless Internet usage and home office productivity
- Connect your computers, wireless printers, smartphones, and other wireless devices at up to 300 Mbps of transfer speed
- Use four Fast Ethernet (10/100 Mbps) ports to directly connect wired devices
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
