Cisco IOS XE Web UI Zero-Day: How One Bug Compromised Tens of Thousands of Devices

When Cisco disclosed CVE-2023-20198 on October 16, 2023, it came with an unusual admission: exploitation was already underway, against an unknown but apparently large number of devices, before any patch existed. By the time independent researchers finished scanning the public internet days later, estimates of compromised Cisco IOS XE devices ran into the tens of thousands.

What the vulnerability does

CVE-2023-20198 lives in the Web UI feature of Cisco IOS XE Software — the operating system that powers a large share of the world’s enterprise switches, routers, and wireless LAN controllers. The flaw carries the maximum CVSS score of 10.0 because of how little an attacker needs: no authentication, no special access, just the ability to reach the device’s web management interface.

Successful exploitation lets a remote attacker create a local user account with privilege level 15 — Cisco’s top privilege tier, equivalent to full administrative control of the device. From there, attackers were observed pairing the bug with a second vulnerability, CVE-2023-20273, to inject a persistent implant directly into the device’s filesystem.

The scale of exploitation

This wasn’t a narrow, targeted campaign. Within days of Cisco’s disclosure, scans of the public internet found tens of thousands of IOS XE devices carrying signs of the implant — a number that made this one of the largest network-device compromise events of 2023. Devices with the web UI feature exposed directly to the internet — a configuration many administrators use for remote management — were the most exposed.

Cisco’s Talos threat intelligence team published detection guidance, including a curl-based check administrators could run to look for the implant’s signature file, and urged any organization running IOS XE with internet-facing web management to assume compromise and re-image affected devices rather than simply patch and move on, since the implant could survive in some configurations.

CISA’s response

CVE-2023-20198 was added to the CISA Known Exploited Vulnerabilities catalog with an expedited remediation deadline reflecting both the severity and the confirmed in-the-wild exploitation. Federal civilian agencies running affected Cisco gear were required to patch or disconnect exposed devices on a compressed timeline.

What administrators should do

Cisco’s guidance was consistent: disable the web UI feature on internet-facing devices where it isn’t strictly required, apply the patched IOS XE release, and check for the implant specifically — patching alone does not remove an implant already deployed on a compromised device. Full technical detail, affected platforms, and patch availability are in Cisco’s security advisory and the CISA KEV catalog entry.

This article describes the vulnerability’s impact and Cisco’s official mitigation guidance only — it does not include exploit code or step-by-step attack instructions.