CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability

CVE-2023-20198 is a privilege escalation vulnerability in the web user interface of Cisco IOS XE. A remote, unauthenticated attacker can create an account with privilege level 15 access and then use that account to take control of the affected device. Because the Web UI is often left enabled on network infrastructure that sits at the edge of enterprise and service-provider environments, successful exploitation can give an attacker full administrative control over critical routing and switching gear.

This matters for any organization running Cisco IOS XE devices whose Web UI is reachable from untrusted networks. CISA has directed that exposed instances be verified for compliance with BOD 23-02, that vendor mitigations be applied, and that any evidence of compromise be reported immediately.

How it works

The underlying weakness is classified as CWE-420 (Unprotected Alternate Channel). In this case the alternate channel is the HTTP/HTTPS Web UI that Cisco IOS XE presents for device management. The flaw allows an unauthenticated remote party to create a new local user account that is granted the highest privilege level (15). Once that account exists, the attacker can authenticate through the normal management interfaces and reconfigure the device, install persistent access, or pivot deeper into the network.

Exact request sequences and any required conditions are not described here; defenders must consult the official Cisco advisory for the precise technical details of the attack surface and the conditions under which the vulnerability can be triggered.

Am I affected? How to find it in your systems

Cisco IOS XE is the operating system used on a wide range of Cisco routers, switches, and wireless controllers. The vulnerable component is the Web UI feature, which may be enabled by default or by configuration on many of these platforms.

• Inventory every Cisco IOS XE device (show version, inventory tools, CMDB, or network discovery scanners).
• Determine whether the HTTP or HTTPS server (Web UI) is enabled and whether it is reachable from the internet or from untrusted internal segments.
• Confirm the software train and any interim fixes against the vendor advisory; do not rely on version numbers published elsewhere.
• Review local user databases and AAA logs for unexpected accounts that possess privilege level 15, especially accounts created outside normal change windows.
• Look for anomalous Web UI access patterns, new local users, or configuration changes that coincide with the period of active exploitation.

Any device whose Web UI is exposed to the internet or to untrusted networks should be treated as high priority for both patching and compromise assessment.

How to remediate

The primary remediation is to apply the software update or configuration guidance published by Cisco for CVE-2023-20198. Confirm the exact fixed releases and any required interim work-arounds directly from the vendor advisory before deploying them in production.

• Schedule and apply the vendor-supplied update as soon as testing permits.
• After patching, re-verify that the Web UI is either disabled or properly restricted, and that no unauthorized privilege-15 accounts remain.
• Enforce least-privilege management access: require AAA (TACACS+/RADIUS) rather than local accounts, and limit management plane reachability with ACLs or control-plane policing.
• Disable the HTTP/HTTPS server entirely if the Web UI is not required for day-to-day operations.

CISA also requires that organizations verify compliance with BOD 23-02 for any internet-facing or untrusted-network-facing instances and report confirmed compromises.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with the following compensating controls:

• Immediately remove the Web UI from any interface that faces the internet or untrusted networks (interface ACLs, management VRF isolation, or complete disablement of the HTTP/HTTPS server).
• Segment management traffic so that only a tightly controlled jump-host or out-of-band network can reach the device’s management plane.
• If a web application firewall or reverse proxy sits in front of the UI, apply vendor-recommended virtual-patching rules once they become available; treat this only as a temporary bridge.
• Increase monitoring for new local user creation, privilege-level changes, and unexpected configuration commits; alert on any such events.
• Where possible, force all administrative access through multi-factor authentication and centralized AAA so that a newly created local account has limited utility.

These steps do not eliminate the vulnerability; they only shrink the attack surface until the official fix can be applied.

If your data may have been exposed

Actively exploited infrastructure vulnerabilities frequently lead to broader network compromise and data exposure. If your Cisco IOS XE devices were reachable and unpatched, treat them as potentially compromised: follow the vendor’s published indicators of compromise, collect forensic images if warranted, and report confirmed incidents to CISA as required. Separately, you can run a free exposure scan of your email addresses against known breach data sets to determine whether credentials or personal information associated with your organization have already appeared in public dumps.