Cisco IOS XE Web UI CVE-2023-20198 (unauthenticated privilege 15 account creation exploited to install implants, CISA KEV): which releases fix it and how do I check for the implant?

What it is: CVE-2023-20198 is a privilege escalation flaw in the Web UI feature of Cisco IOS XE (CVSS 10) that let an unauthenticated remote attacker create a privileged local account on the device. Cisco and others saw exploitation from September 2023 in which attackers then used a second flaw (CVE-2023-20273) to gain root and plant an implant, affecting tens of thousands of devices. CISA added it to KEV on October 16, 2023. Am I affected: - Cisco IOS XE devices (routers, switches, wireless controllers) with the HTTP or HTTPS server feature enabled, which is controlled by the ip http server and ip http secure-server commands. Devices without those commands are not exploitable through this path. - Check with show running-config | include ip http server|secure|active and show version. Fix: 1. Install a fixed release. Cisco's first fixed releases include 17.9.4a, 17.6.6a, 17.3.8a and 16.12.10a (Catalyst 3650/3850), with newer releases also fixed. Use Cisco's Software Checker for your exact train. 2. Disable the web UI on internet-facing devices (no ip http server and no ip http secure-server), or restrict it with access lists to trusted management hosts. Cisco states ACLs are effective. 3. Check for compromise using Cisco's published indicators: unknown local users in the configuration and log messages about configuration made by the web UI process, and unexpected file installation messages in the logs. Cisco also described a way to query the device for the implant's presence, which is documented in the advisory and in Cisco Talos guidance. The implant does not survive a reload, but the created accounts do, so remove them. 4. If the implant or rogue accounts were found, treat the device as compromised: reimage it, rotate all credentials, SNMP strings and keys, and review configuration and network traffic from the device. Verify: show version shows a fixed release, the web UI is disabled or ACL-restricted, and show running-config lists only expected users. Sources: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z https://nvd.nist.gov/vuln/detail/CVE-2023-20198 https://www.cisa.gov/known-exploited-vulnerabilities-catalog