VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 07:12 UTC
← Dashboard

CVE-2023-20198

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previou…

Read full description
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.6/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 10: +1.50
  • Fresh EPSS: 99.61%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 30 documents and public datasets.

Hype components

Headline sample (25%)
10/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
0/100
HYPE TOTAL6/100

Sources and documents

SANS Internet Storm Center, InfoCON: green
Press · 05 Nov 2026, 15:29 · Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)
SC Media
Press · 30 Sep 2026, 07:00 · Stop patching by score – and start patching by authority - SC Media
The Hacker News
Press · 26 Jun 2026, 07:00 · New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks - The Hacker News
Cybersecurity Dive
Press · 05 Nov 2025, 08:00 · Hackers targeting Cisco IOS XE devices with BadCandy implant - Cybersecurity Dive
SDxCentral
Press · 05 Nov 2025, 08:00 · Cisco users face BadCandy in latest threat to network giant - SDxCentral
See all 30 source documents
Security Affairs
Press · 01 Nov 2025, 07:00 · BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government - Security Affairs
The Hacker News
Press · 01 Nov 2025, 07:00 · ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability - The Hacker News
The Hacker News
Press · 24 Jun 2025, 07:00 · China-linked Salt Typhoon Exploits Critical Cisco Vulnerability to Target Canadian Telecom - The Hacker News
Industrial Cyber
Press · 24 Jun 2025, 07:00 · Chinese state linked Salt Typhoon suspected in cyberattacks on Canadian telecom networks - Industrial Cyber
Cybersecurity Dive
Press · 25 Feb 2025, 08:00 · Attackers exploiting Cisco vulnerabilities tied to Salt Typhoon campaign - Cybersecurity Dive
GreyNoise
Press · 24 Feb 2025, 08:00 · GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks - GreyNoise
The Hacker News
Press · 21 Feb 2025, 08:00 · Cisco Confirms Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks - The Hacker News
Cyber Security Agency of Singapore
Press · 19 Feb 2025, 08:00 · Active Exploitation of Cisco Internetworking Operating System eXtended Edition - Cyber Security Agency of Singapore
Recorded Future
Press · 13 Feb 2025, 08:00 · RedMike Cyber Attack on Cisco Devices in Telecommunications - Recorded Future
Kroll
Press · 07 Nov 2023, 08:00 · SkeletonXE - Responding to the CISCO Vulnerability (CVE-2023-20198) - Kroll
BleepingComputer
Press · 30 Oct 2023, 07:00 · Exploit released for critical Cisco IOS XE flaw, many hosts still hacked - BleepingComputer
EclecticIQ Blog
Press · 25 Oct 2023, 07:00 · Cisco IOS XE Web UI Privilege Escalation Vulnerability; Sandworm Targets Ukrainian Telecom - EclecticIQ Blog
BleepingComputer
Press · 23 Oct 2023, 07:00 · Cisco patches IOS XE zero-days used to hack over 50,000 devices - BleepingComputer
National Cyber Security Centre
Press · 23 Oct 2023, 07:00 · Exploitation of Cisco IOS XE vulnerabilities affecting UK organisations - National Cyber Security Centre
GreyNoise
Press · 20 Oct 2023, 07:00 · Unpacking CVE-2023-20198: A Critical Weakness In Cisco IOS XE: - GreyNoise
SecurityWeek
Press · 18 Oct 2023, 07:00 · Tens of Thousands of Cisco Devices Hacked via Zero-Day Vulnerability - SecurityWeek
CCB Belgium
Press · 18 Oct 2023, 07:00 · WARNING: CRITICAL VULNERABILITY IN CISCO IOS XE, RISK OF REMOTE UNAUTHENTICATED PRIVILEGE ESCALATION AND SYSTEM TAKEOVER ON SYSTEMS RUNNING WEB UI AND HTTP/HTTPS SERVICES - CCB Belgium
Unit 42
Press · 18 Oct 2023, 07:00 · Threat Brief: Cisco IOS XE Web UI Privilege Escalation Vulnerability (Updated) - Unit 42
TechTarget
Press · 17 Oct 2023, 07:00 · Cisco IOS XE zero-day facing mass exploitation - TechTarget
Ars Technica
Press · 17 Oct 2023, 07:00 · “Cisco buried the lede.” >10,000 network devices backdoored through unpatched 0-day - Ars Technica
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 17 Oct 2023, 07:00 · Cisco IOS XE Escalation of Privilege Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
Rapid7
Press · 17 Oct 2023, 07:00 · CVE-2023-20198: Active Exploitation of Cisco IOS XE Zero-Day Vulnerability - Rapid7
Cisco Talos Blog
Press · 16 Oct 2023, 07:00 · Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities - Cisco Talos Blog
Arctic Wolf
Press · 16 Oct 2023, 07:00 · Recommendations for CVE-2023-20198 - Arctic Wolf
The Record from Recorded Future News
Press · 16 Oct 2023, 07:00 · Cisco: Hackers targeting zero-day found in internet-exposed routers - The Record from Recorded Future News

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 0.0Reality 9.005 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 0.6Reality 9.006 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 0.8Reality 9.006 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 0.6Reality 9.0Nov 2Nov 5Nov 6Nov 6

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

8

Public exploit entries / repo candidates

See 8 repos with metrics
RepositoryStarsForksLanguageUpdated
smokeintheshell/CVE-2023-201986718Python26 Mar 2026, 20:39
Tounsi007/CVE-2023-20198116—17 Oct 2023, 14:02
Pushkarup/CVE-2023-2019886Python23 Oct 2023, 19:10
iveresk/cve-2023-2019865Python20 Oct 2023, 21:51
sohaibeb/CVE-2023-2019842Python19 Feb 2025, 16:14
G4sul1n/Cisco-IOS-XE-CVE-2023-2019830Python11 Apr 2025, 16:00
djayaGit/cve-2023-20198-poc-cisco10—22 Nov 2024, 04:12
JoyGhoshs/CVE-2023-2019800Python18 Oct 2023, 07:58
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 10; EPSS 99.6%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-06 01:03:58.685854+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Added to the CISA KEV catalog
16 Oct 2023, 00:00
First press mention
16 Oct 2023, 07:00
Published
16 Oct 2023, 15:12
Latest press mention
05 Nov 2026, 15:29
Score calculated
06 Nov 2026, 01:03
PoCs on GitHub
8 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar