Secuno
ENNL
Book demo

CVE-2023-20198

Cisco IOS XE Web UI Privilege Escalation

10.0 CRITICALActively exploited (CISA KEV)EPSS 99.6%
  1. Published16 Oct 2023
  2. Added to CISA KEV16 Oct 2023
  3. Remediation due20 Oct 2023
Actively exploited (CISA KEV)

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

Added to KEV: 16 Oct 2023Federal remediation due: 20 Oct 2023

Description

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Cisco iOS XE≥ 16.12 < 16.12.10a · ≥ 17.3 < 17.3.8a · ≥ 17.6 < 17.6.6a · ≥ 17.9 < 17.9.4a
Rockwellautomation Allen-bradley Stratix 5200 Firmware< 17.12.02
Rockwellautomation Allen-bradley Stratix 5800 Firmware< 17.12.02

Remediation

Fixed in
Cisco iOS XE≥ 16.12.10a
Rockwellautomation Allen-bradley Stratix 5200 Firmware≥ 17.12.02
Rockwellautomation Allen-bradley Stratix 5800 Firmware≥ 17.12.02

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-402178.8
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via…
CVE-2025-620018.8
BullWall Ransomware Containment supports configurable file and directory exclusions…
CVE-2025-133159.8
Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An…
CVE-2025-539678.0
Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to…
CVE-2025-85578.8
An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered…
CVE-2025-543518.9
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for…

Frequently asked

Is CVE-2023-20198 being actively exploited?

Yes. CVE-2023-20198 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 16 Oct 2023.

How severe is CVE-2023-20198?

CVE-2023-20198 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 99.6% probability of exploitation.

Which products are affected by CVE-2023-20198?

Affected products include Cisco iOS XE, Rockwellautomation Allen-bradley Stratix 5200 Firmware, Rockwellautomation Allen-bradley Stratix 5800 Firmware.

How do I fix CVE-2023-20198?

Upgrade affected software to a fixed version, for example Cisco iOS XE 16.12.10a, Rockwellautomation Allen-bradley Stratix 5200 Firmware 17.12.02, Rockwellautomation Allen-bradley Stratix 5800 Firmware 17.12.02 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-20198 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.