CVE-2023-20198: Cisco IOS XE Web UI privilege escalation

CVE-2023-20198 is a critical (CVSS 10.0) privilege-escalation vulnerability in the web UI feature of Cisco IOS XE Software that lets an unauthenticated remote attacker create a fully privileged local account; it was actively exploited to implant persistent malicious code on internet-facing devices, and the affected code also ships in Rockwell Automation Allen-Bradley Stratix industrial switches.

CVE-2023-20198 affects the web UI feature of Cisco IOS XE Software — enabled via the ip http server or ip http secure-server commands. Cisco's investigation found that an unauthenticated remote attacker could issue a privilege-level-15 command through this interface to create a local user and password combination, which could then be used to log in with that account's access (NVD).

Both NVD and Cisco's own PSIRT score it CVSS v3.1 10.0 (critical): network-reachable, low attack complexity, no privileges or user interaction required, and a full compromise of confidentiality, integrity and availability (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Cisco's advisory describes attackers chaining this flaw with a second, related issue it assigned as CVE-2023-20273 (CVSS 7.2) to escalate the new account's privileges to root and write an implant to the device's file system (NVD).

CISA added CVE-2023-20198 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-10-16, the day it was disclosed, with a required-action due date of 2023-10-20 — one of the shortest remediation windows in the catalog — reflecting that exploitation was already underway at disclosure (CISA KEV).

Cisco's security advisory confirms "Cisco is aware of active exploitation of these vulnerabilities" and lists IOS XE 17.9 (fixed in 17.9.4a), 17.6 (fixed in 17.6.6a), 17.3 (fixed in 17.3.8a) and 16.12 on Catalyst 3650/3850 (fixed in 16.12.10a) as affected when the web UI feature is enabled; disabling the HTTP/HTTPS server (no ip http server / no ip http secure-server) or restricting access with an access list is described as an interim mitigation until a device can be upgraded (Cisco Security Advisory cisco-sa-iosxe-webui-privesc-j22SaA4z).

Because IOS XE also runs on certain Rockwell Automation industrial Ethernet switches, NVD's configuration data additionally lists Rockwell Automation Allen-Bradley Stratix 5200 and 5800 firmware before 17.12.02 (fixed in 17.12.02) as affected, extending this vulnerability's reach from enterprise network gear into OT/industrial network equipment (NVD).

As of 2026-10-20, FIRST scores the probability of exploitation at the top of the EPSS distribution (EPSS 0.9961, 99.948th percentile) (FIRST EPSS).

Any IOS XE device or Rockwell Stratix switch with the web UI enabled and not yet on a fixed release should be upgraded immediately; where immediate upgrade is not possible, disabling the HTTP/HTTPS server feature removes the attack vector until that can happen.

• Unauthenticated attacker can use the IOS XE web UI feature to create a privilege-level-15 local account, gaining administrative access. — NVD
• NVD and Cisco PSIRT both score it CVSS v3.1 10.0 (critical); Cisco describes chaining with CVE-2023-20273 to escalate to root and implant code. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2023-10-16 with a required-action due date of 2023-10-20. — CISA KEV
• Cisco confirms active exploitation; affected IOS XE releases are 16.12 (Catalyst 3650/3850), 17.3, 17.6 and 17.9 with the web UI enabled; disabling the HTTP/HTTPS server is an interim mitigation. — Cisco Security Advisory cisco-sa-iosxe-webui-privesc-j22SaA4z
• NVD's configuration data also lists Rockwell Automation Allen-Bradley Stratix 5200 and 5800 firmware before 17.12.02 as affected. — NVD
• EPSS score is 0.9961 (99.948th percentile) as of 2026-10-20. — FIRST EPSS