Is CVE-2023-20198 actively exploited?

Yes. CVE-2023-20198 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2023-20198 be exploited remotely?

The attack vector of CVE-2023-20198 has not been classified yet.

What is the CVSS score of CVE-2023-20198?

CVE-2023-20198 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2023-20198

HIGHCISA KEVIN THE WILD

CVE-2023-20198

Published: October 16, 2023

EPSS:94.01%probability of exploitation in 30 daysPercentile:99.9th

Official Description

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

NVD Source

CISA KEV Advisory

Cisco IOS XE Web UI Privilege Escalation Vulnerability

Added to KEV: 2023-10-16Federal patch deadline: 2023-10-20

Required Action (CISA)

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

Risk Analysis

A privilege escalation vulnerability in the Cisco IOS XE Web UI allows an unauthenticated, remote attacker to create an account with full administrative privileges. This enables the attacker to gain complete control of the affected device. The high EPSS score and confirmed exploitation in the wild make this an extremely urgent vulnerability.

This vulnerability is actively exploited in the wild and is included in CISA's KEV catalog. It is remotely exploitable without authentication.

Recommended Action

Apply the latest security updates for Cisco IOS XE to patch this vulnerability. Restrict access to the web UI to trusted networks and implement strong authentication policies.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-20198 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-20198 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.