Vendor

Cisco

Vulnerabilities in Cisco IOS XE, ASA, and other network infrastructure — the gear that, when compromised, hands attackers the keys to entire networks.

CVEs

CVE-2023-20198

[ CRITICAL ] CVSS 10.0 kev

Cisco IOS XE Web UI Privilege Escalation Zero-Day

A privilege-escalation vulnerability in the Web UI feature of Cisco IOS XE Software allows a remote, unauthenticated attacker to create an account with privilege level 15 (full admin) access, enabling full device takeover. Exploited at mass scale against tens of thousands of devices.

Cisco / IOS XE Software Oct 16, 2023

Articles

~/articles/2026-06-24-cisco-ios-xe-web-ui-zero-day-mass-exploitation

Explainer

cisco

Cisco IOS XE Web UI Zero-Day: How One Bug Compromised Tens of Thousands of Devices

CVE-2023-20198, a maximum-severity privilege-escalation flaw in Cisco IOS XE's web management interface, was exploited at mass scale before a patch existed — handing attackers full admin control of network infrastructure.

Jun 24 read →