{"uuid": "575fa199-c876-4b54-80a7-c001464ac419", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-20198", "type": "exploited", "source": "https://t.me/hacking_Attack/123125", "content": "Black Hat Ethical Hacking\nCisco\u2019s IOS XE Vulnerability Allows Complete Takeover, actively exploited\n\nCisco\u2019s IOS XE Vulnerability Allows Complete Takeover, actively exploited\nPost Views: 2 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nCisco has issued a critical security warning to administrators regarding a severe authentication bypass zero-day vulnerability present in its IOS XE software. This flaw enables unauthenticated attackers to gain full administrator privileges and, troublingly, allows them to take complete control of routers and switches remotely.\n\nThis critical vulnerability has been officially tracked as CVE-2023-20198 and is still awaiting a patch. It exclusively affects devices that have the Web User Interface (Web UI) feature enabled, in combination with the HTTP or HTTPS Server feature activated.\n\nCisco has identified active exploitation of this previously unknown vulnerability in the Web User Interface (Web UI) feature of the Cisco IOS XE software. Notably, this exploitation occurs when these devices are exposed to the internet or untrusted networks.\n\nThe successful exploitation of this vulnerability grants malicious actors the capability to create an account on the compromised device, specifically with privilege level 15 access. This effectively provides them with full control over the affected device, potentially leading to unauthorized activities.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThe alarm was first raised on September 28, when Cisco\u2019s Technical Assistance Center (TAC) detected unusual behavior on a customer\u2019s device. Further investigation revealed related activities dating back to September 18.\n\nThe attackers employed an authorized user to create a local user account with the username \u201ccisco_tac_admin\u201d from a suspicious IP address, 5.149.249[.]74. Later, additional activity linked to CVE-2023-20198 exploitation emerged on October 12, involving the creation of a \u201ccisco_support\u201d local user account from a different suspicious IP address, 154.53.56[.]231. These attackers also deployed a malicious implant to execute arbitrary commands at the system or IOS levels.\n\nCisco\u2019s analysis suggests that these clusters of activities were likely orchestrated by the same threat actor. The initial cluster may have represented the actor\u2019s initial testing, while the October activity showcased an expansion of their operation, including establishing persistent access through the implant.\n\nTo mitigate this threat, Cisco recommends administrators disable the HTTP server feature on internet-facing systems, effectively removing the attack vector and blocking potential attacks.\n\nThe company advises customers to utilize commands such as \u201cno ip http server\u201d or \u201cno ip http secure-server\u201d in global configuration mode to disable the HTTP Server feature. Additionally, after disabling this feature, the command \u201ccopy running-configuration startup-configuration\u201d should be executed to ensure that the HTTP Server feature does not unexpectedly enable during system reloads.\n\nFor those using both the HTTP and HTTPS servers, it\u2019s crucial to implement both commands to disable the HTTP Server feature completely.\nTrending: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Trending: Recon Tool: fetchmeurls\nFurthermore, organizations are strongly encouraged to scrutinize their systems for unexplained or recently created user accounts, which might indicate malicious activities associated with this threat.\n\nTo identify the presence of the malicious implant on compromised Cisco IOS XE devices, yo[...]", "creation_timestamp": "2026-09-04T03:00:04.823006Z"}