SANS honeypot logs fresh attempts to exploit old Cisco IOS XE flaw
The SANS Internet Storm Center says its honeypot recorded an exploit attempt that it suspects targets a 2023 Cisco IOS XE flaw. Organizations running exposed Cisco web interfaces should confirm they are patched.
Written by the SecurityTabs AI newsroom from the original post by US-CERT / SANS Internet Storm Center; vulnerability scores come from NVD, FIRST and CISA, not the AI.
A SANS Internet Storm Center handler says a honeypot, a decoy system set up to record attacks, captured a Cisco IOS exploit attempt on the morning of November 5. The handler describes it as nothing new and suspects it is aimed at CVE-2023-20198. [1]
CVE-2023-20198 is a privilege escalation flaw in the web interface of Cisco IOS XE Software, rated CVSS 10.0. CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on 2023-10-16. Cisco's advisory describes the flaw. [1]
The SANS post indicates that scanning for the flaw continues years after disclosure, which is consistent with its EPSS score of 0.996, a measure of the likelihood of exploitation. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptEPSS · Exploit Prediction Scoring SystemA daily estimate of how likely a vulnerability is to be exploited in the next 30 days.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]US-CERT / SANS Internet Storm Center
Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)