CVE-2023-20198 is a critical vulnerability with a severity score of 10.0, affecting the web UI feature in Cisco IOS XE Software. This vulnerability allows attackers to exploit two previously unknown issues, gaining initial access and then elevating their privileges to root level. The affected systems include various Cisco IOS XE versions, making it a significant concern for organizations using these software configurations.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, you'll need to check your Cisco IOS XE Software version. The affected versions are Cisco IOS XE Software versions from 16.12 up to (excluding) 16.12.10a, Cisco IOS XE Software versions from 17.3 up to (excluding) 17.3.8a, Cisco IOS XE Software versions from 17.6 up to (excluding) 17.6.6a, Cisco IOS XE Software versions from 17.9 up to (excluding) 17.9.4a. If your software version falls within these ranges, your system may be vulnerable. It's important to stay informed and take necessary precautions to protect your network.

What should I do if I'm affected?

If you're affected by the vulnerability, follow these steps. Check for available patches from Cisco and apply them promptly. If no patches are available, disable the web UI feature. Monitor your network for suspicious activity. Stay updated on the latest security advisories and follow recommended actions.

Is CVE-2023-20198 in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. The CVE-2023-20198 vulnerability, also known as Cisco IOS XE Web UI Privilege Escalation Vulnerability, was added to the catalog on October 16, 2023, with a due date of October 20, 2023. The required action is to verify compliance with BOD 23-02 and apply mitigations as per vendor instructions. If a system is found to be compromised, it should be reported to CISA immediately.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-420 (Unprotected Alternate Channel) and Insufficient Information. These weaknesses can lead to unauthorized access and privilege escalation in affected systems.

For more details

CVE-2023-20198 is a critical vulnerability affecting Cisco IOS XE Software, with severe consequences if exploited. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• Cisco Security Advisory

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities

• Known Exploited Vulnerabilities Catalog