CVE-2023-20198
CRITICALCISA KEVEPSS 100th pctlDescription
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
How to fix
TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploit Intelligence
Very high risk: more likely to be exploited than 100% of all known CVEs.
Cisco IOS XE Web UI Privilege Escalation Vulnerability
Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.
Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Remediation due: 2023-10-20
References
Related Vulnerabilities
Other CWE-420 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2025-54309 | Critical | 9.0 | 94% | KEV | Fix |
| CVE-2024-10081 | Critical | 10.0 | 39% | - | Fix |
| CVE-2025-13315 | Critical | 9.8 | 33% | - | - |
| CVE-2024-6242 | Unscored | - | 9.2% | - | - |
| CVE-2025-53967 | High | 8.0 | 7.4% | - | - |
| CVE-2026-40217 | High | 8.8 | 6.5% | - | Fix |
Common questions
How do I fix CVE-2023-20198?
Published advisories record a fix for 3 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.
Is CVE-2023-20198 being actively exploited?
Yes. CVE-2023-20198 is listed in the CISA Known Exploited Vulnerabilities catalog, which means exploitation has been observed in the wild. US federal agencies were required to remediate it by 2023-10-20. Treat it as a priority whatever its CVSS score says.
How severe is CVE-2023-20198?
CVE-2023-20198 has a CVSS v3 base score of 10.0, rated critical. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.
What does CVE-2023-20198 affect?
Published advisories record a fix for allen-bradley stratix 5200 firmware (NVD), allen-bradley stratix 5800 firmware (NVD), ios xe (NVD). Only products with a sourced advisory are listed, so treat this as what we can cite rather than a complete inventory.
Embed a live status badge for CVE-2023-20198
Markdown
[](https://tridentstack.com/cve/CVE-2023-20198)HTML
<a href="https://tridentstack.com/cve/CVE-2023-20198"><img src="https://tridentstack.com/cve/badge/CVE-2023-20198.svg" alt="CVE-2023-20198"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-10-28.