CVE-2023-20198 Explained: Cisco IOS XE Web UI Zero-Day and the 50,000-Device Compromise

CVE-2023-20198 affects Cisco IOS XE devices, including switches, routers, and wireless controllers, where the HTTP Server feature (web management interface) is enabled and accessible. The vulnerability allows an unauthenticated attacker to send a crafted HTTP request to the web UI that triggers a code path creating a new local user account with privilege level 15.

Privilege level 15 in IOS XE is equivalent to root in Unix systems, full enable mode access with unrestricted configuration rights. The created account is functional immediately upon creation with no email confirmation, MFA challenge, or approval workflow.

With the newly created admin account, attackers then exploited CVE-2023-20273, a command injection vulnerability in the web UI's diagnostic tools, to execute arbitrary commands as root on the IOS XE operating system. This second vulnerability elevated access from IOS-level administrator to the underlying Linux kernel running IOS XE.

The final stage: deployment of a Lua-based implant injected into the Nginx web server process. The implant accepted commands through specially crafted HTTP requests matching a specific URL pattern, providing persistent backdoor access. The implant was designed to appear in health check responses as inactive to evade detection, and was updated by attackers partway through the exploitation campaign specifically to hide from newly published detection queries.

The 50,000-device compromise scale of CVE-2023-20198 is striking, but the deeper concern is what network infrastructure access enables that endpoint compromise does not.

A compromised IOS XE switch or router sits in the data path for all traffic traversing it. An attacker with root access to a network device can: capture plaintext traffic (including credentials on non-encrypted protocols), perform man-in-the-middle attacks against encrypted sessions by intercepting TLS on embedded inspection hardware, manipulate routing tables to redirect traffic flows, create persistent tunnels that bypass security monitoring, and disable port security and 802.1X controls that restrict device access to the network.

Detection is harder than for endpoint compromise. Network device agents are uncommon. EDR visibility does not extend to IOS XE. Syslog and SNMP monitoring provides limited behavioral telemetry compared to endpoint logging. The Lua implant deployed in CVE-2023-20198 exploitation specifically targeted the HTTP server process, a legitimate component, making process-based detection difficult.

The attacker's decision to update the implant mid-campaign to evade published detection methods indicates a sophisticated operator with ongoing operational awareness, monitoring security industry response and adapting in near-real-time.

Cisco released patches in October and November 2023. Detection and remediation require multiple steps due to the persistence mechanism.