{"uuid": "5771da26-7e4a-4b17-942e-04b958e4f5c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-20273", "type": "exploited", "source": "https://t.me/hacking_Attack/124049", "content": "Black Hat Ethical Hacking\nCisco Warns For A Second Zero-Day in IOS XE Exploited for Device Infections\n\nCisco Warns For A Second Zero-Day in IOS XE Exploited for Device Infections\nPost Views: 18 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nCisco recently issued a warning about not one but two zero-day vulnerabilities within its IOS XE Software, both actively exploited in the wild. This alarming discovery follows Cisco\u2019s initial disclosure of CVE-2023-20198, a critical zero-day vulnerability with a CVSS score of 10, which is actively under attack.\n\nThe company came across these vulnerabilities during its response to multiple Technical Assistance Center (TAC) support cases. Threat actors have not wasted any time and have already leveraged CVE-2023-20198 to compromise thousands of Cisco IOS XE devices, according to a warning from cybersecurity firm VulnCheck.\n\nThis zero-day flaw grants attackers the power to gain administrator privileges, effectively enabling them to take control of vulnerable routers. Cisco\u2019s advisory explains that exploitation of this vulnerability allows remote, unauthenticated attackers to create an account on an affected system with privilege level 15 access. Once this account is created, it can be used to assume control of the compromised system.\n\nThe vulnerability impacts both physical and virtual devices that are running the Web User Interface (Web UI) feature, especially when the HTTP or HTTPS Server feature is in use.\n\nCisco recommends that administrators examine system logs for specific log messages containing usernames like \u201ccisco_tac_admin,\u201d \u201ccisco_support,\u201d or any other locally configured users that are unfamiliar to the network. As a precaution, administrators are urged to disable the HTTP server feature on systems exposed to the internet.\n\nSecurity researchers have been actively tracking the aftermath of these attacks. LeakIX utilized indicators of compromise (IoCs) from Cisco Talos and identified approximately 30,000 Cisco IOS XE devices (routers, switches, VPNs) that had fallen victim to the exploitation of CVE-2023-20198. Most of these compromised devices were located in the United States, the Philippines, Chile, and Mexico. CERT Orange Cyberdefense reported similar findings, with over 34,500 compromised devices using the same IoCs.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nIn a startling twist, Cisco\u2019s investigation into these attacks revealed an attempt to hide infections even on systems patched against CVE-2023-20198. This raised suspicions of a second zero-day vulnerability in action. The attackers initially exploited CVE-2023-20198 to gain entry, creating a local user and password combination, which was then used for subsequent logins. This initial access was further exploited using another component of the web UI feature, allowing the attacker to elevate privileges to root and implant malware on the system. This second zero-day was designated CVE-2023-20273.\n\nThe severity scores for these vulnerabilities are as follows: CVE-2023-20198 scored a perfect 10.0, while CVE-2023-20273 received a score of 7.2.\n\nThe IT giant has now addressed both zero-day vulnerabilities and also provided mitigations for them.\nCisco IOS XE Software Release Train First Fixed Release Available 17.9 17.9.4a Yes 17.6 17.6.6a TBD 17.3 17.3.8a TBD 16.12 (Catalyst 3650 and 3850 only) 16.12.10a TBD \nTrending: Necurs: Uncovering the Sophisticated Botnet\nTrending: Offensive Security Tool: o365sprayer Notably, cybersecurity experts observed a decrease in the number of infected devices, largely attributed to attackers\u2019 attempts to [...]", "creation_timestamp": "2026-09-05T01:00:43.733188Z"}