CVE-2023-20198

CVE-2023-20198 is a critical-severity vulnerability in Cisco Ios Xe with a CVSS 3.x base score of 10.0. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2023-10-16). The underlying weakness is classified as CWE-420.

Key facts

Description

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

Frequently asked questions

What is CVE-2023-20198?
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
How severe is CVE-2023-20198?
CVE-2023-20198 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-20198 being actively exploited?
Yes. CVE-2023-20198 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-10-16, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2023-20198?
CVE-2023-20198 primarily affects Cisco Ios Xe. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-20198?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2023-20198 have an EU (EUVD) identifier?
Yes. CVE-2023-20198 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-24377. It is also flagged as exploited in the EUVD (since 2023-10-16).
When was CVE-2023-20198 published?
CVE-2023-20198 was published on 2023-10-16 and last updated on 2026-06-17.

References

Affected products (3)

More vulnerabilities in Cisco Ios Xe

All CVEs affecting Cisco Ios Xe →

Other CWE-420 vulnerabilities

Browse all CWE-420 vulnerabilities →