Security News > 2023 > October > New Critical Zero-Day Vulnerability Affects Web UI of Cisco IOS XE Software & Allows Attackers to Compromise Routers
Cisco Talos discovered a new critical zero-day vulnerability in the Web User Interface feature of Cisco IOS XE software that's currently being used in the wild.
The vulnerability used to access the system and create those accounts is CVE-2023-20198; it received the highest Common Vulnerability Scoring System score of 10.
How to mitigate this Cisco IOS XE software security threat.
Only Cisco IOS XE software can be targeted by this vulnerability exploitation.
For organizations using that software, Cisco strongly recommends disabling the HTTP server feature on all internet-facing systems so the Web UI is no longer accessible.
Log files should be checked carefully for every user accessing the web UI. In addition, in the findings reported by Cisco Talos, an attacker could exploit a vulnerability patched since 2021 for further compromise.
- Alert: Ivanti Releases Patch for Critical Vulnerability in Endpoint Manager Solution (source)
- Cisco says critical Unity Connection bug lets attackers get root (source)
- Cisco Fixes High-Risk Vulnerability Impacting Unity Connection Software (source)
- Critical Cisco Unity Connection flaw gives attackers root privileges. Patch now! (CVE-2024-20272) (source)
- GitLab warns of critical zero-click account hijacking vulnerability (source)
- Critical RCE Vulnerability Uncovered in Juniper SRX Firewalls and EX Switches (source)
- Patch time: Critical GitLab vulnerability exposes 2FA-less users to account takeovers (source)
- Zero-Day Alert: Update Chrome Now to Fix New Actively Exploited Vulnerability (source)
- Apple Issues Patch for Critical Zero-Day in iPhones, Macs - Update Now (source)
- Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP! (source)