Cisco IOS XE Web UI (CVE-2023-20198)

In October 2023 it turned out that attackers were creating accounts on Cisco routers and switches at scale. Cisco Talos later traced the first activity back to 18 September; Cisco’s support centre (TAC) received the first case on 28 September. To create those accounts the attackers did not have to guess a password or chain a vulnerability: the management interface did it for them. Planting their implant did take a second flaw.

What is CVE-2023-20198

IOS XE has a web interface for administration. By constructing a request in a particular way, an unauthenticated visitor could create a local account at the highest privilege level. From that point on they were an administrator of the device.

In practice the attackers logged in with that account and then exploited a second flaw in the same web interface, CVE-2023-20273 (CVSS 7.2), to escalate to root and write an implant to the file system. Through it they could run commands on the device. The implant itself was not persistent: a reboot removed it. The rogue local accounts did survive a reboot, and with them the attacker’s administrator access.

Why this is mostly a lesson about exposure

The bug was serious, but what created the scale was something else: tens of thousands of devices had their management interface on the open internet. A management interface belongs on a management network, not on the whole world. That is exactly what security misconfiguration describes.

Had the interface only been reachable internally, the same vulnerability would have been a problem for whoever was already inside, not for anyone with a connection.

Why it is still relevant

This is not a closed chapter. In August 2025 CISA, the NSA, the FBI and partner agencies from twelve other countries, the Netherlands and Germany among them, listed CVE-2023-20198 and CVE-2023-20273 among the vulnerabilities that Chinese state-sponsored actors use to compromise networks worldwide. That activity overlaps with what the security industry calls Salt Typhoon. In late October 2025 the Australian Signals Directorate (ASD) reported that more than 150 devices in Australia still carried the implant, now known as BADCANDY. A reboot clears it, but a device that is not patched can simply be infected again.

What to do now

• Disable the HTTP and HTTPS server feature on devices that do not need it, and otherwise restrict it to a management network.
• Move the devices to a supported IOS XE release that contains the fixes from the Cisco advisory. They close both vulnerabilities.
• Review the configuration for accounts nobody can account for, and remove them after investigating rather than before. A reboot removes the implant, not those accounts.
• Inventory which of your organisation’s management interfaces are reachable from the internet. Exposure like this is usually the first finding in a penetration test.