CVE-2023-20198: Cisco IOS XE Web UI unauthenticated admin account creation, mass-exploited
The short version: CVE-2023-20198 is a flaw in the web management interface of Cisco IOS XE that lets an unauthenticated, remote attacker create a local account with privilege level 15 — full control of the device. It scores a perfect 10.0, it was exploited at scale (tens of thousands of implanted devices), it's in CISA's KEV catalog, and it's typically chained with CVE-2023-20273 to gain root and drop an implant. If your IOS XE Web UI is exposed, this is patch-and-verify now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 10.0 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 99.57% · 99.94th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-10-20 |
| Known exploited? | Yes — mass exploitation as a zero-day; tens of thousands of devices implanted |
| Vulnerability type | CWE-420 unprotected alternate channel → unauthenticated privilege-15 account creation |
| Requires authenticated session? | No — pre-authentication |
| Affected | Cisco IOS XE with the HTTP/HTTPS Server (Web UI) feature enabled |
| Fixed in | Fixed releases across the 17.9, 17.6, 17.3, and 16.12 trains (see advisory for exact builds) |
What you need to know
The IOS XE Web UI exposed functionality it shouldn't have, letting an unauthenticated attacker issue a privilege-15 command that creates a new local administrator account. With that account they log in and control the device.
- It's the network device itself. Privilege 15 on a router or switch means control of the box that moves and filters your traffic.
- It's pre-authentication and internet-reachable wherever the Web UI (
ip http server/ip http secure-server) is exposed — no credential, no chain. - It was mass-exploited and chained. Attackers used it as a zero-day at scale, then chained CVE-2023-20273 to elevate to root and write an implant; researchers counted tens of thousands of compromised devices within days.
- Attackers created telltale accounts. Usernames like
cisco_tac_admin,cisco_support, andcisco_sys_managerwere observed.
How serious we see it
Critical — the 10.0 is not hyperbole.
Unauthenticated, network-reachable, full administrative control of a network device, confirmed exploited en masse, is the definition of top-of-queue. The bounded, reassuring part is that exposure hinges on one thing you control — whether the Web UI is reachable — and disabling it removes the attack surface outright. The catch is the mass-exploitation window: any device that had the Web UI exposed before you fixed it should be checked for rogue accounts and implants, because patched and clean are separate questions.
Recommendations
Straight from Cisco's advisory and CISA:
- Patch now. Upgrade to a fixed IOS XE release for your train (17.9 / 17.6 / 17.3 / 16.12 — see the advisory for exact builds).
- Disable or restrict the Web UI. If you don't need it, turn it off with
no ip http server/no ip http secure-server; otherwise restrict it to trusted networks. This is the mitigation until you can patch. - Hunt. Check for unknown local users (including the observed
cisco_*names) and for implants on the file system. - If compromised, respond fully. Remove rogue accounts, rebuild as needed, and rotate credentials.
- Confirm your exposure first. Verify whether the HTTP/HTTPS Server feature is enabled and internet-reachable.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing Cisco IOS XE Web UI interfaces, fingerprints the device, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top because it's in KEV. We detect and flag the exposed, affected interface; we don't exploit it.
The whole point of a continuous, attacker's-eye view is a flaw like this: when a network-device zero-day breaks, the exposed Web UI is already mapped, so you go straight to patch, restrict, and verify.