#VU82065 Improper Privilege Management in Cisco IOS XE - CVE-2023-20198
Published: October 17, 2023 / Updated: April 18, 2025
Vulnerability identifier: #VU82065
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2023-20198
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Cisco IOS XE
Cisco IOS XE
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper privilege management in the web UI feature. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected device and create an account with privilege level 15 access.
Note, the vulnerability is being actively exploited in the wild.
Remediation
Install update from vendor's website.
External links
- https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh87343
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
- https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting/
- https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/