Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
cisco ios xe |
This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute a payload with root privileges. The vulnerable IOS XE versions are: 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4, 16.3.5, 16.3.5b, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.3.10, 16.3.11, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.2, 16.6.3, 16.6.4, 16.6.5, 16.6.4s, 16.6.4a, 16.6.5a, 16.6.6, 16.6.5b, 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.6.10, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1s, 16.8.1c, 16.8.1d, 16.8.2, 16.8.1e, 16.8.3, 16.9.1, 16.9.2, 16.9.1a, 16.9.1b, 16.9.1s, 16.9.1c, 16.9.1d, 16.9.3, 16.9.2a, 16.9.2s, 16.9.3h, 16.9.4, 16.9.3s, 16.9.3a, 16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8, 16.9.8a, 16.9.8b, 16.9.8c, 16.10.1, 16.10.1a, 16.10.1b, 16.10.1s, 16.10.1c, 16.10.1e, 16.10.1d, 16.10.2, 16.10.1f, 16.10.1g, 16.10.3, 16.11.1, 16.11.1a, 16.11.1b, 16.11.2, 16.11.1s, 16.11.1c, 16.12.1, 16.12.1s, 16.12.1a, 16.12.1c, 16.12.1w, 16.12.2, 16.12.1y, 16.12.2a, 16.12.3, 16.12.8, 16.12.2s, 16.12.1x, 16.12.1t, 16.12.2t, 16.12.4, 16.12.3s, 16.12.1z, 16.12.3a, 16.12.4a, 16.12.5, 16.12.6, 16.12.1z1, 16.12.5a, 16.12.5b, 16.12.1z2, 16.12.6a, 16.12.7, 16.12.9, 16.12.10, 17.1.1, 17.1.1a, 17.1.1s, 17.1.2, 17.1.1t, 17.1.3, 17.2.1, 17.2.1r, 17.2.1a, 17.2.1v, 17.2.2, 17.2.3, 17.3.1, 17.3.2, 17.3.3, 17.3.1a, 17.3.1w, 17.3.2a, 17.3.1x, 17.3.1z, 17.3.3a, 17.3.4, 17.3.5, 17.3.4a, 17.3.6, 17.3.4b, 17.3.4c, 17.3.5a, 17.3.5b, 17.3.7, 17.3.8, 17.4.1, 17.4.2, 17.4.1a, 17.4.1b, 17.4.1c, 17.4.2a, 17.5.1, 17.5.1a, 17.5.1b, 17.5.1c, 17.6.1, 17.6.2, 17.6.1w, 17.6.1a, 17.6.1x, 17.6.3, 17.6.1y, 17.6.1z, 17.6.3a, 17.6.4, 17.6.1z1, 17.6.5, 17.6.6, 17.7.1, 17.7.1a, 17.7.1b, 17.7.2, 17.10.1, 17.10.1a, 17.10.1b, 17.8.1, 17.8.1a, 17.9.1, 17.9.1w, 17.9.2, 17.9.1a, 17.9.1x, 17.9.1y, 17.9.3, 17.9.2a, 17.9.1x1, 17.9.3a, 17.9.4, 17.9.1y1, 17.11.1, 17.11.1a, 17.12.1, 17.12.1a, 17.11.99SW
Vulmon
msf > use exploit/linux/misc/cisco_ios_xe_rce
msf exploit(cisco_ios_xe_rce) > show targets
...targets...
msf exploit(cisco_ios_xe_rce) > set TARGET < target-id >
msf exploit(cisco_ios_xe_rce) > show options
...show and set options...
msf exploit(cisco_ios_xe_rce) > exploitThis module leverages CVE-2023-20198 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute arbitrary CLI commands with privilege level 15. You must specify the IOS command mode to execute a CLI command in. Valid modes are `user`, `privileged`, and `global`. To run a command in "Privileged" mode, set the `CMD` option to the command you want to run, e.g. `show version` and set the `MODE` to `privileged`. To run a command in "Global Configuration" mode, set the `CMD` option to the command you want to run, e.g. `username hax0r privilege 15 password hax0r` and set the `MODE` to `global`. The vulnerable IOS XE versions are: 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4, 16.3.5, 16.3.5b, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.3.10, 16.3.11, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.2, 16.6.3, 16.6.4, 16.6.5, 16.6.4s, 16.6.4a, 16.6.5a, 16.6.6, 16.6.5b, 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.6.10, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1s, 16.8.1c, 16.8.1d, 16.8.2, 16.8.1e, 16.8.3, 16.9.1, 16.9.2, 16.9.1a, 16.9.1b, 16.9.1s, 16.9.1c, 16.9.1d, 16.9.3, 16.9.2a, 16.9.2s, 16.9.3h, 16.9.4, 16.9.3s, 16.9.3a, 16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8, 16.9.8a, 16.9.8b, 16.9.8c, 16.10.1, 16.10.1a, 16.10.1b, 16.10.1s, 16.10.1c, 16.10.1e, 16.10.1d, 16.10.2, 16.10.1f, 16.10.1g, 16.10.3, 16.11.1, 16.11.1a, 16.11.1b, 16.11.2, 16.11.1s, 16.11.1c, 16.12.1, 16.12.1s, 16.12.1a, 16.12.1c, 16.12.1w, 16.12.2, 16.12.1y, 16.12.2a, 16.12.3, 16.12.8, 16.12.2s, 16.12.1x, 16.12.1t, 16.12.2t, 16.12.4, 16.12.3s, 16.12.1z, 16.12.3a, 16.12.4a, 16.12.5, 16.12.6, 16.12.1z1, 16.12.5a, 16.12.5b, 16.12.1z2, 16.12.6a, 16.12.7, 16.12.9, 16.12.10, 17.1.1, 17.1.1a, 17.1.1s, 17.1.2, 17.1.1t, 17.1.3, 17.2.1, 17.2.1r, 17.2.1a, 17.2.1v, 17.2.2, 17.2.3, 17.3.1, 17.3.2, 17.3.3, 17.3.1a, 17.3.1w, 17.3.2a, 17.3.1x, 17.3.1z, 17.3.3a, 17.3.4, 17.3.5, 17.3.4a, 17.3.6, 17.3.4b, 17.3.4c, 17.3.5a, 17.3.5b, 17.3.7, 17.3.8, 17.4.1, 17.4.2, 17.4.1a, 17.4.1b, 17.4.1c, 17.4.2a, 17.5.1, 17.5.1a, 17.5.1b, 17.5.1c, 17.6.1, 17.6.2, 17.6.1w, 17.6.1a, 17.6.1x, 17.6.3, 17.6.1y, 17.6.1z, 17.6.3a, 17.6.4, 17.6.1z1, 17.6.5, 17.6.6, 17.7.1, 17.7.1a, 17.7.1b, 17.7.2, 17.10.1, 17.10.1a, 17.10.1b, 17.8.1, 17.8.1a, 17.9.1, 17.9.1w, 17.9.2, 17.9.1a, 17.9.1x, 17.9.1y, 17.9.3, 17.9.2a, 17.9.1x1, 17.9.3a, 17.9.4, 17.9.1y1, 17.11.1, 17.11.1a, 17.12.1, 17.12.1a, 17.11.99SW
msf > use auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198
msf auxiliary(cisco_ios_xe_cli_exec_cve_2023_20198) > show actions
...actions...
msf auxiliary(cisco_ios_xe_cli_exec_cve_2023_20198) > set ACTION < action-name >
msf auxiliary(cisco_ios_xe_cli_exec_cve_2023_20198) > show options
...show and set options...
msf auxiliary(cisco_ios_xe_cli_exec_cve_2023_20198) > runThis module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute arbitrary OS commands with root privileges. This module leverages CVE-2023-20198 to create a new admin user, then authenticating as this user, CVE-2023-20273 is leveraged for OS command injection. The output of the command is written to a file and read back via the webserver. Finally the output file is deleted and the admin user is removed. The vulnerable IOS XE versions are: 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4, 16.3.5, 16.3.5b, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.3.10, 16.3.11, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.2, 16.6.3, 16.6.4, 16.6.5, 16.6.4s, 16.6.4a, 16.6.5a, 16.6.6, 16.6.5b, 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.6.10, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1s, 16.8.1c, 16.8.1d, 16.8.2, 16.8.1e, 16.8.3, 16.9.1, 16.9.2, 16.9.1a, 16.9.1b, 16.9.1s, 16.9.1c, 16.9.1d, 16.9.3, 16.9.2a, 16.9.2s, 16.9.3h, 16.9.4, 16.9.3s, 16.9.3a, 16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8, 16.9.8a, 16.9.8b, 16.9.8c, 16.10.1, 16.10.1a, 16.10.1b, 16.10.1s, 16.10.1c, 16.10.1e, 16.10.1d, 16.10.2, 16.10.1f, 16.10.1g, 16.10.3, 16.11.1, 16.11.1a, 16.11.1b, 16.11.2, 16.11.1s, 16.11.1c, 16.12.1, 16.12.1s, 16.12.1a, 16.12.1c, 16.12.1w, 16.12.2, 16.12.1y, 16.12.2a, 16.12.3, 16.12.8, 16.12.2s, 16.12.1x, 16.12.1t, 16.12.2t, 16.12.4, 16.12.3s, 16.12.1z, 16.12.3a, 16.12.4a, 16.12.5, 16.12.6, 16.12.1z1, 16.12.5a, 16.12.5b, 16.12.1z2, 16.12.6a, 16.12.7, 16.12.9, 16.12.10, 17.1.1, 17.1.1a, 17.1.1s, 17.1.2, 17.1.1t, 17.1.3, 17.2.1, 17.2.1r, 17.2.1a, 17.2.1v, 17.2.2, 17.2.3, 17.3.1, 17.3.2, 17.3.3, 17.3.1a, 17.3.1w, 17.3.2a, 17.3.1x, 17.3.1z, 17.3.3a, 17.3.4, 17.3.5, 17.3.4a, 17.3.6, 17.3.4b, 17.3.4c, 17.3.5a, 17.3.5b, 17.3.7, 17.3.8, 17.4.1, 17.4.2, 17.4.1a, 17.4.1b, 17.4.1c, 17.4.2a, 17.5.1, 17.5.1a, 17.5.1b, 17.5.1c, 17.6.1, 17.6.2, 17.6.1w, 17.6.1a, 17.6.1x, 17.6.3, 17.6.1y, 17.6.1z, 17.6.3a, 17.6.4, 17.6.1z1, 17.6.5, 17.6.6, 17.7.1, 17.7.1a, 17.7.1b, 17.7.2, 17.10.1, 17.10.1a, 17.10.1b, 17.8.1, 17.8.1a, 17.9.1, 17.9.1w, 17.9.2, 17.9.1a, 17.9.1x, 17.9.1y, 17.9.3, 17.9.2a, 17.9.1x1, 17.9.3a, 17.9.4, 17.9.1y1, 17.11.1, 17.11.1a, 17.12.1, 17.12.1a, 17.11.99SW
msf > use auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273
msf auxiliary(cisco_ios_xe_os_exec_cve_2023_20273) > show actions
...actions...
msf auxiliary(cisco_ios_xe_os_exec_cve_2023_20273) > set ACTION < action-name >
msf auxiliary(cisco_ios_xe_os_exec_cve_2023_20273) > show options
...show and set options...
msf auxiliary(cisco_ios_xe_os_exec_cve_2023_20273) > runCVE-2023-20198 & 0Day Implant Scanner
Cisco-IOS-EX-Scanner (CVE-2023-20198) CVE-2023-20198 & 0Day Implant Scanner (tested in a lab and works, YMMV) Quick and dirty scanner to run checks if the host is vulnerable/been compromised using 0day in Cisco IOS XE This tool is designed to scan a given target or a list of targets to determine potential vulnerabilities based on specific checks Reqs pip install reque
CVE Proof of Concept (POC) search and tracking utility
PoC Man Monitoring platform to identify and catalog Proof of Concept (POC) tools, scanners, or exploitation scripts for various CVE's Usage # Search for CVE and run it every 600 seconds (10 minutes) python pocmanpy CVE-2023-20198 -s 600 TODO [] Expand code to support GitHub Actions workflow bot that runs on schedule, sends messages
CVE-2023-20198 PoC (!)
CVE-2023-20198 CVE-2023-20198 PoC (!) Description perform actions on a target web server The script demonstrates how to create a local user account, install an implant, restart the web server, check for the presence of the implant, and finally, clean up by deleting the created user account Disclaimer: This script is intended for educational purposes only Unauthorized use of
cisco-CVE-2023-20198-tester
Cisco Tester: Vulnerability Detection Script Table of Contents Overview Features Prerequisites Installation Usage Output Contributing Overview The cisco_testerpy script is designed to assess multiple IP addresses for a specific Cisco vulnerability (CVE-2023-20198) It performs an HTTP or HTTPS POST request to each IP and checks for a specific string in the response to identi
Checker for CVE-2023-20198 , Not a full POC Just checks the implementation and detects if hex is in response or not
CVE-2023-20198 Checker for CVE-2023-20198 , Not a full POC Just checks the implementation and detects if hex is in response or not
CVE-2023-20198 Checkscript
CVE-2023-20198 CVE-2023-20198 Checkscript based on: Technical analysis: blogtalosintelligencecom/active-exploitation-of-cisco-ios-xe-software/ First script version: githubcom/Atea-Redteam/CVE-2023-20198/ Thanks to Atea Redteam for their work Requires: Python37+ Python libs: ipaddress, requests, subprocess, re, argparse Different ways to launch the scrip
1vere$k POC on the CVE-2023-20198
cve-2023-20198 Description 1vere$k POC on the CVE-2023-20198 based on the Blog Also including a check on hexademical response according to the original Cisco article The script works in the two modes: check mode which is just makes a connection for the particular URL and checks a response code If it is 200OK and in the same time response is less then 32 symbols it is a po
This script can identify if Cisco IOS XE devices are vulnerable to CVE-2023-20198
CVE_2023_20198_Detector This script can identify if Cisco IOS XE devices are vulnerable to CVE-2023-20198 The script takes as input a csv file with all the device IP addresses that you want to check By default the script looks for a file named "devicescsv"; you can name the file something different but then you must pass the "--devices" argument to the sc
Simple-Ansible-for-CVE-2023-20198 This is a very simple playbook to detect and disable http/https server to prevent the vulnerability Getting started Simply use the Cisco Always on Sandbox to test example Log into sandbox router and turn on http/https server ssh developer@sandbox-iosxe-recomm-1ciscocom pass=lastorangerestoreball8876
CVE-2023-20198 Checkscript
CVE-2023-20198 CVE-2023-20198 Checkscript based on: blogtalosintelligencecom/active-exploitation-of-cisco-ios-xe-software/ Including the updated where there is an Authorization header to check for the known implant !! Upgraded to look for upgraded implant The script checks length of returned response with code 200, and checks if length is shorter then 32 characters
Awvs Scanner、fahai
AWVS Update InfO 本仓库及相关资源仅供个人测试，请勿用于非法用途 This warehouse and related resources are for personal testing only, please do not use them for illegal purposes Latest 239231020153 New security checks New Security Check: CVE-2023-20198 New Security Check: CVE-2023-22515 Improvements Multiple improvements to the SSL Engine Impr
Awvs Scanner、fahai
AWVS Update InfO 本仓库及相关资源仅供个人测试，请勿用于非法用途 This warehouse and related resources are for personal testing only, please do not use them for illegal purposes Latest 239231020153 New security checks New Security Check: CVE-2023-20198 New Security Check: CVE-2023-22515 Improvements Multiple improvements to the SSL Engine Impr
CVE-2023-20198 CVE-2023-20198 Checkscript based on: Technical analysis: blogtalosintelligencecom/active-exploitation-of-cisco-ios-xe-software/ First script version: githubcom/Atea-Redteam/CVE-2023-20198/ Thanks to Atea Redteam for their work Requires: Python37+ Python libs: ipaddress, requests, subprocess, re, argparse Different ways to launch the scrip
A Go-based Exploit Framework
go-exploit: Go Exploit Framework go-exploit is an exploit development framework for Go The framework helps exploit developers create small, self-contained, portable, and consistent exploits The framework was developed to simplify large scale scanning, exploitation, and integration with other tools For API documentation, check out the package on pkggodev/githubcom/vulnch
🔍 Cisco IOS XE Web UI Vulnerability Scanner - CVE-2023-20198 🚨 🚫 Critical Risk | CVSS: 100 | 📅 Updated: Oct 17, 2023 Overview: A swift and powerful scanner for detecting critical vulnerabilities in the web UI of Cisco IOS XE Software Protect your system from unauthorized level 15 access, putting control at risk! 🌟 Features: 📌 Spot potential implants for s
A command line tool that converts the entire SigmaHQ Ruleset into STIX 2.1 Objects
sigma2stix A command line tool that converts the entire SigmaHQ Ruleset into STIX 21 Objects Overview Sigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner The rule format is very flexible, easy to write and applicable to any type of log file SigmaHQ/sigma Sigma Rules are written in a YAML format, and distr
Cisco CVE-2023-20198
Cisco_CVE-2023-20198 Cisco CVE-2023-20198 👉 Cisco warned of a critical authentication bypass zero-day vulnerability (CVE-2023-20198) in its IOS XE software that allows unauthenticated attackers to gain full administrative privileges 👨💻 The vulnerability only affects devices with the Web User Interface (Web UI) feature enabled that also have the HTTP or HTTPS Ser
This is a script to aid in responding to Cisco Smart Install SMI misuse. Threat is covered in detailed by US-CERT alert TA18-106A.
CiscoResponse This is a Python3 script initially created to aid in responding to Cisco Smart Install SMI misuse Threat is covered in detailed by US-CERT alert TA18-106A As other use cases are found, they will also be added For example CVE-2023-20198 as documented here can be checked by using the custom command (-x) option A Cisco feature called Smart Install (SMI) can be ex
Cisco IOS XE Implant Detection Script Script created by @JairoCCIE to check if a Cisco IOS XE device is vulnerable to CVE-2023-20198 The CVE is detailed in the Cisco Talos advisory blogtalosintelligencecom/active-exploitation-of-cisco-ios-xe-software/ Ongoing exploitation How to verify with a simple curl curl -k -H "Authorization: 0ff4fbf0ecffa77ce8d3852a292
An Exploitation script developed to exploit the CVE-2023-20198 Cisco zero day vulnerability on their IOS routers
CVE-2023-20198 An Exploitation script developed to exploit the CVE-2023-20198 Cisco zero day vulnerability on their IOS XE Hackers have been widely exploiting the this vulnerability which creates a 15 level privilege user by bypassing the authentication Which a malicous xml content make this exploitation the webui endpoint of ciscoThis is not only for Exploitation also detects
A PoC for CVE 2023-20198
CVE 2023-20198 Introduction The web UI component of Cisco IOS XE Software has a previously undiscovered vulnerability that, when exposed to the internet or untrusted networks, is already being actively exploited, according to Cisco Due to this vulnerability, a remote, unauthenticated attacker is able to set up an account with privilege level 15 access on a vulnerable system
This is a webshell fingerprinting scanner designed to identify implants on Cisco IOS XE WebUI's affected by CVE-2023-20198 and CVE-2023-20273
Cisco IOS XE Device Scanner User Guide for CVE-2023-20198-Scanner This is a webshell fingerprinting scanner designed to identify implants on Cisco IOS XE WebUI's affected by CVE-2023-20198 and CVE-2023-20273 This Python script checks for compromised Cisco IOS XE devices by making HTTP and HTTPS requests It supports multiple ways to specify target IPs and provides threadi
CVE-2023-20198 & 0Day Implant Scanner
Cisco-IOS-EX-Scanner (CVE-2023-20198) CVE-2023-20198 & 0Day Implant Scanner (tested in a lab and works, YMMV) Quick and dirty scanner to run checks if the host is vulnerable/been compromised using 0day in Cisco IOS XE This tool is designed to scan a given target or a list of targets to determine potential vulnerabilities based on specific checks Reqs pip install reque
Checks the status of 'ip http server' and 'ip http secure-server' on Cisco networking devices
Check-HttpServerStatus Introduction This script is in direct response to recent Cisco Vulnerabilities (CVE-2023-20198 and CVE-2023-20273) in which the http server on Cisco IOS-XE devices can be used to gain unathorized access This script will check the status of the http server so you can identify which devices will need to be configured Notes The included 'inventorycsv
Cisco IOS XE implant scanning & detection (CVE-2023-20198, CVE-2023-20273)
Cisco IOS XE implant scanning & network detection Network detection of CVE-2023-20198 exploitation and fingerprinting of post-exploitation of Cisco IOS XE devices CVE-2023-20198 Suricata network detection The suricata/ folder contains Suricata detection rules for exploitation of CVE-2023-20198 These rules monitor for a percent-encoded-percent which can be used to bypa
Check a target IP for CVE-2023-20198
CVE-2023-20198 Check a target IP for CVE-2023-20198 python mainpy TARGET_IP
CVE-2023-20198 Exploit PoC
CVE-2023-20198 Exploit PoC for CVE-2023-20198 Description CVE-2023-20198 is characterized by improper path validation to bypass Nginx filtering to reach the webui_wsma_http web endpoint without requiring authentication By bypassing authentication to the endpoint, an attacker can execute arbitrary Cisco IOS commands or issue configuration changes with Privilege 15 privileges C
CVE-2023-20198 / 0day - Cisco - Authentication Bypass/RCE
CVE-2023-20198- CVE-2023-20198 / 0day - Cisco - Authentication Bypass/RCE
CISCO CVE POC SCRIPT
CVE-2023-20198 - PoC SCRIPT /!\ Disclaimer: This script is provided 'as is' and exclusively for educational purposes Users are strongly advised to exercise caution and utilize it within the boundaries of legal and ethical considerations Description Execute various actions on a target web server, such as creating and/or deleting a local user account, restarting the
Check for and remediate conditions that make an IOS-XE device vulnerable to CVE-2023-20198
CVE-2023-20198-Fix This repository contains an Ansible playbook for remediating the CVE-2023-20198 vulnerability found in certain Cisco devices It does the following: Checks if the web service is running on the router by checking for the associated commands in the running config Disables the web service if running Saves the configuration if changed Checks the logs for signs o
CVE-2023-20198-IOS-XE-Scanner Single threaded scanner for a single IP in PowerShell Very quick and dirty PoC to show the concept Tested in lab Use at own risk! Other scanners (python) githubcom/fox-it/cisco-ios-xe-implant-detection githubcom/Shadow0ps/CVE-2023-20198-Scanner
CVE-2023-20198-RCE, support adding/deleting users and executing cli commands/system commands.
CVE-2023-20198-RCE CVE-2023-20198-RCE, support adding/deleting users and executing cli commands/system commands
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Initial fall in infected devices indicates evolution, not extinction, of attack code
After a six-day wait, Cisco started rolling out a patch for a critical bug that miscreants had exploited to install implants in thousands of devices. Alas, it seems to have been largely useless. The flaw in the networking giant's IOS XE software, which allowed criminals to hijack thousands of Cisco switches and routers, first came to light last Monday. On Friday, Cisco said it hoped to have a fix ready on Sunday, ruining the weekend for many admins. The good news: Cisco kept its Sunday pro...
Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.