Cisco IOS XE zero-day bug exploited

Share post:

Cisco users have been advised to disable the web UI feature on all internet-facing devices immediately after the company disclosed a critical zero-day vulnerability in its IOS XE software that is being actively exploited in the wild.

The vulnerability, CVE-2023-20198, allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access, essentially giving them complete control of the device.

Cisco says the flaw affects physical and virtual devices running its IOS XE software, with the HTTP or HTTPS Server feature turned on. The networking giant hasn’t published a full list of devices that are at risk.

Also, there’s no patch or workaround. Hence, Cisco “strongly recommends” that customers disable this feature on all internet-facing systems. This also echoes guidance from the U.S. Cybersecurity and Infrastructure Security Agency on how to mitigate risk from internet-exposed management interfaces.

“To disable the HTTP Server feature, use the no ip http server or no ip http secure-server command in global configuration mode,” Cisco’s advisory recommends . “If both the HTTP server and HTTPS server are in use, both commands are required to disable the HTTP Server feature.”

The sources for this piece include an article in TheRegister.

Featured Tech Jobs


Related articles

Leaked documents may show the inside of China’s hacking strategy

Documents apparently stolen by disgruntled employees to embarrass their firm may give insight into China's cyber

Abuse of valid accounts by threat actors hits a high, says IBM

Attackers are finding that obtaining valid credentials is an easier route to achieving their goals, s

Cyber Security Today, Feb. 21, 2024 – A patch warning from ConnectWise, the latest ransomware news, and more

This episode reports on a report comparing business email compromise attacks against ransomware

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways