Hazard

Is CVE-2023-20198 being exploited?

Weaponised and widely attempted

Reliable public exploit code exists, or mass exploitation attempts are probable. Patch inside days, not weeks.

Cisco IOS XE Web UI Privilege Escalation Vulnerability

Cisco · IOS XE Web UI

CVSS 10 EPSS 100% no public exploit indexed Fix deadline passed 20 October 2023

What it is

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

Why we say that

  • EPSS puts exploitation in the next 30 days at 100%
  • CISA's federal remediation deadline (2023-10-20) has passed
  • CVSS 10 critical
  • Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.

What it costs when this goes wrong

This is where UK enforcement meets the vulnerability record. Where an unfixed vulnerability leads to a breach, the ICO treats it as a security failure under UK GDPR. Recent cases:

All UK cases caused by unpatched software →