CVE-2023-20198 is a critical (CVSS 10.0) privilege-escalation vulnerability in the web UI feature of Cisco IOS XE Software that lets an unauthenticated remote attacker create a fully privileged local account; it was actively exploited to implant persistent malicious code on internet-facing devices, and the affected code also ships in Rockwell Automation Allen-Bradley Stratix industrial switches.
Vulnerability summary
CVSS base score
10
Critical severity
EPSS score (FIRST)
99.6%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2023-20198 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Cisco IOS XE Software 16.12 (e.g. Catalyst 3650/3850, web UI feature enabled) | cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* | 16.12 through 16.12.9 (fixed in 16.12.10a) |
| Cisco IOS XE Software 17.3 (web UI feature enabled) | cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* | 17.3 through 17.3.7 (fixed in 17.3.8a) |
| Cisco IOS XE Software 17.6 (web UI feature enabled) | cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* | 17.6 through 17.6.5 (fixed in 17.6.6a) |
| Cisco IOS XE Software 17.9 (web UI feature enabled) | cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* | 17.9 through 17.9.3 (fixed in 17.9.4a) |
| Rockwell Automation Allen-Bradley Stratix 5200 (industrial Ethernet switch running IOS XE) | cpe:2.3:o:rockwellautomation:allen-bradley_stratix_5200_firmware:*:*:*:*:*:*:*:* | Firmware before 17.12.02 (fixed in 17.12.02) |
| Rockwell Automation Allen-Bradley Stratix 5800 (industrial Ethernet switch running IOS XE) | cpe:2.3:o:rockwellautomation:allen-bradley_stratix_5800_firmware:*:*:*:*:*:*:*:* | Firmware before 17.12.02 (fixed in 17.12.02) |
What does this mean for affected devices?
CVE-2023-20198 affects the web UI feature of Cisco IOS XE Software — enabled via the ip http server or ip http secure-server commands. Cisco's investigation found that an unauthenticated remote attacker could issue a privilege-level-15 command through this interface to create a local user and password combination, which could then be used to log in with that account's access (NVD).
Both NVD and Cisco's own PSIRT score it CVSS v3.1 10.0 (critical): network-reachable, low attack complexity, no privileges or user interaction required, and a full compromise of confidentiality, integrity and availability (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Cisco's advisory describes attackers chaining this flaw with a second, related issue it assigned as CVE-2023-20273 (CVSS 7.2) to escalate the new account's privileges to root and write an implant to the device's file system (NVD).
CISA added CVE-2023-20198 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-10-16, the day it was disclosed, with a required-action due date of 2023-10-20 — one of the shortest remediation windows in the catalog — reflecting that exploitation was already underway at disclosure (CISA KEV).
Cisco's security advisory confirms "Cisco is aware of active exploitation of these vulnerabilities" and lists IOS XE 17.9 (fixed in 17.9.4a), 17.6 (fixed in 17.6.6a), 17.3 (fixed in 17.3.8a) and 16.12 on Catalyst 3650/3850 (fixed in 16.12.10a) as affected when the web UI feature is enabled; disabling the HTTP/HTTPS server (no ip http server / no ip http secure-server) or restricting access with an access list is described as an interim mitigation until a device can be upgraded (Cisco Security Advisory cisco-sa-iosxe-webui-privesc-j22SaA4z).
Because IOS XE also runs on certain Rockwell Automation industrial Ethernet switches, NVD's configuration data additionally lists Rockwell Automation Allen-Bradley Stratix 5200 and 5800 firmware before 17.12.02 (fixed in 17.12.02) as affected, extending this vulnerability's reach from enterprise network gear into OT/industrial network equipment (NVD).
As of 2026-10-20, FIRST scores the probability of exploitation at the top of the EPSS distribution (EPSS 0.9961, 99.948th percentile) (FIRST EPSS).
Any IOS XE device or Rockwell Stratix switch with the web UI enabled and still on an unfixed release should be upgraded immediately; where immediate upgrade is not possible, disabling the HTTP/HTTPS server feature removes the attack vector until that can happen.
Evidence
- Unauthenticated attacker can use the IOS XE web UI feature to create a privilege-level-15 local account, gaining administrative access. — NVD
- NVD and Cisco PSIRT both score it CVSS v3.1 10.0 (critical); Cisco describes chaining with CVE-2023-20273 to escalate to root and implant code. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2023-10-16 with a required-action due date of 2023-10-20. — CISA KEV
- Cisco confirms active exploitation; affected IOS XE releases are 16.12 (Catalyst 3650/3850), 17.3, 17.6 and 17.9 with the web UI enabled; disabling the HTTP/HTTPS server is an interim mitigation. — Cisco Security Advisory cisco-sa-iosxe-webui-privesc-j22SaA4z
- NVD's configuration data also lists Rockwell Automation Allen-Bradley Stratix 5200 and 5800 firmware before 17.12.02 as affected. — NVD
- EPSS score is 0.9961 (99.948th percentile) as of 2026-10-20. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
How fast did CISA require action after CVE-2023-20198 was disclosed?
CISA added it to the Known Exploited Vulnerabilities catalog the same day it was disclosed, 2023-10-16, with a required-action due date of just 2023-10-20 — one of the shortest remediation windows in the catalog — reflecting that exploitation was already underway at disclosure (per CISA KEV).
Does exploiting CVE-2023-20198 alone give an attacker full device control?
Not by itself. Cisco's investigation found attackers chaining this flaw with a second issue, CVE-2023-20273 (CVSS 7.2), to escalate the newly created account's privileges to root and write a persistent implant to the device's file system (per NVD).
Is this vulnerability limited to Cisco networking equipment?
No. Because Cisco IOS XE also runs on certain Rockwell Automation industrial Ethernet switches, NVD's configuration data lists Rockwell Automation Allen-Bradley Stratix 5200 and 5800 firmware before 17.12.02 as affected too, extending the vulnerability's reach into OT/industrial network equipment (per NVD).
What can be done if an affected IOS XE device can't be upgraded immediately?
Cisco's advisory describes disabling the HTTP/HTTPS server feature (no ip http server / no ip http secure-server) or restricting access with an access list as an interim mitigation until the device can be upgraded to a fixed release (per Cisco Security Advisory cisco-sa-iosxe-webui-privesc-j22SaA4z).
How severe and how likely to be exploited is CVE-2023-20198?
Both NVD and Cisco's own PSIRT score it the maximum CVSS v3.1 10.0 (critical). FIRST's EPSS model separately scores the probability of exploitation at 0.9961 — the 99.948th percentile — as of 2026-10-20 (per NVD; per FIRST EPSS).
Questions about this page?