Cisco IOS XE Zero-Day CVE-2023-20198: Risks and Fixes

Cisco recently issued a cautionary alert concerning a zero-day vulnerability within its IOS XE Software. This article aims to provide a detailed overview of this vulnerability and its potential impact on network security. The article will also share insights into risk assessment and proffer recommendations to mitigate the associated risks.

Risk Scoring and Identification:

This vulnerability has been allocated the identifier CVE-2023-20198 and has received a Common Vulnerability Scoring System version 3 (CVSSv3) score of 10, marking it as critical. Such a score demonstrates the severity and implies that immediate action is imperative.

Details of the Vulnerability:

Cisco reported the active exploitation of a previously unknown vulnerability within the Web User Interface (Web UI) of its IOS XE Software. This issue arises when the software is exposed to the internet or untrusted networks, thus allowing unauthorized users to assume complete control over affected devices. Interestingly, the flaw seems to affect both physical and virtual devices, but only when they have the Web User Interface (Web UI) activated, alongside either the HTTP or HTTPS Server feature enabled. This highlights the specific conditions for potential exploitation.

Timeline of Detection and Exploitation:

The vulnerability initially came to light when unusual behavior was reported on a customer device. Cisco's Technical Assistance Center (TAC) first noticed the malicious activities on September 28, 2023. Upon further investigation, they discovered that such activities could be traced back to September 18. Additionally, a separate incident was noted on October 12, 2023, where a malicious implant was deployed for arbitrary command execution. This suggests a deliberate, ongoing operation.

Recommendations for Immediate Action:

Disable the HTTP Server Feature:

Administrators are advised to promptly disable the HTTP Server feature on all systems that are exposed to the internet or untrusted networks. This can be done by using the command 'no ip http server' or 'no ip http secure-server' in the global configuration mode. After doing so, it's essential to save the running configuration to prevent the feature from becoming reactivated.

Check for Unexplained User Accounts:

It's crucial for organizations to scrutinize user accounts on the affected devices meticulously. Any newly created or suspicious accounts could indicate an ongoing threat and should be investigated and removed immediately.

Identify the Malicious Implant:

Cisco provides a specific command to detect the presence of the malicious implant. Network administrators should employ this command to ascertain whether their devices have been compromised.

Regular System Monitoring:

Given the severity of the vulnerability, continuous monitoring of network activities is advised. Prompt detection of any suspicious behavior will facilitate a rapid response.

Software Updates:

While Cisco is still in the process of developing a patch, administrators should remain vigilant for any updates and apply them as soon as they are available.

Network Segmentation:

As an added precaution, implementing network segmentation to isolate sensitive systems from public or untrusted networks is recommended. This will further reduce the attack surface.

Final Thoughts:

The discovery of this zero-day vulnerability in Cisco's IOS XE Software underscores the ever-evolving landscape of cybersecurity threats. Organizations must heed Cisco's advice and take immediate steps to mitigate risks. While waiting for a permanent fix, the recommendations provided herein can serve as a robust interim solution to protect against potential exploits.