Log in Request a demo

Exploited vulnerability

Cisco IOS XE web UI flaw (CVE-2023-20198)

CVE-2023-20198

CVE-2023-20198 is a flaw in the web management page of Cisco IOS XE, the software that runs many Cisco routers and switches.

  • On CISA KEV
CVE ID
CVE-2023-20198
CISA KEV
Listed
Affected product
IOS XE Software (web UI feature)
Exploited
Yes
Published
October 2023

In short

CVE-2023-20198 is a flaw in the web management page of Cisco IOS XE, the software that runs many Cisco routers and switches. Cisco says an attacker first used it to create a local account, then used a second flaw to get full control. Cisco rated it 10.0, the top score.

Profile MapVulnerability
  1. CVECVE-2023-20198
  2. ProductCisco IOS XE Software (web UI feature)
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps5actions listedInstall a fixed release · Report positive findings

What it allows

Per CISA, a remote attacker with no login can create an account with privilege level 15, the highest level on a Cisco device. Cisco's investigation found the attacker used that account, then a second flaw (CVE-2023-20273) to raise access to root and write an implant, a hidden piece of attacker software, to the device.

Who is affected

Per Cisco, IOS XE Software is affected if the web UI is turned on, which happens through the ip http server or ip http secure-server setting. Cisco says IOS XE releases before 16 are not affected, and neither are IOS, ASA, FTD, ISE or NX-OS software. See the fixed software table in the Cisco advisory for the exact releases.

Cisco first published its advisory on 16 October 2023 and said it was aware of active exploitation. NVD published the record and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on the same day.

The KEV entry marks ransomware campaign use as Unknown. The sources opened for this page do not tie the flaw to a named ransomware group.

What to do

  1. Turn off the web UI on internet-facing devices

    Cisco strongly recommends disabling the HTTP Server feature on all internet-facing systems, or limiting it to trusted source addresses. Use no ip http server and no ip http secure-server. If both are in use, both commands are needed.

  2. Restrict access with access lists

    Cisco says access lists that limit the web UI to trusted hosts and networks are an effective mitigation.

  3. Install a fixed release

    Cisco lists fixed releases for each software train in the Fixed Software section of its advisory, with a software checker. Use it to pick your release.

  4. Look for unknown local users in the logs

    Cisco says to check logs for login and configuration messages tied to cisco_tac_admin, cisco_support or any local user you do not know.

  5. Report positive findings

    The KEV entry tells US federal bodies to follow Cisco's steps to find out whether a device was compromised and to report positive findings to CISA.

Questions

What is CVE-2023-20198?

CVE-2023-20198 is a flaw in the web management page of Cisco IOS XE. Per CISA, a remote attacker with no login can create an account with privilege level 15, the highest level on a Cisco device.

Which Cisco devices are affected by CVE-2023-20198?

Per Cisco, IOS XE Software is affected if the web UI is turned on through the ip http server or ip http secure-server setting. IOS XE releases before 16 are not affected, and neither are IOS, ASA, FTD, ISE or NX-OS.

How do I protect against CVE-2023-20198?

Cisco strongly recommends disabling the HTTP Server feature on all internet-facing systems, or limiting it to trusted source addresses with access lists. Install a fixed release from the Cisco advisory.

Has CVE-2023-20198 been used by ransomware groups?

The Known Exploited Vulnerabilities entry marks ransomware campaign use as Unknown. The sources on this page do not tie the flaw to a named ransomware group.

In our research

  1. KEV due-date windows and pace of additions October 2026
  2. Salt Typhoon: what telecom customers should do October 2026
  3. Salt Typhoon Threat group

Sources

  1. Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature Cisco
  2. CVE-2023-20198 record NIST NVD
  3. Known Exploited Vulnerabilities catalog (JSON feed) CISA

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Salt Typhoon

Attributed by MITRE ATT&CK to the PRC state and active since at least 2019, Salt Typhoon compromised network equipment at major US telecommunications and internet providers. A joint advisory by 13 countries (27 August 2025) says PRC state-sponsored actors with partly overlapping activity mostly exploit known flaws in routers and edge devices; patch and lock down those devices first.

Read more

Glossary term

Privilege escalation

Privilege escalation is when an attacker gains higher-level permissions than they started with.

Read more