CVE-2023-20198 - CISCO IOS XE Privilege Escalation Vulnerability

Pulsant engineers have conducted and concluded an assessment and carried out mitigation of Client managed devices last week.

Any client who needs mitigation steps has been contacted.

If you have any further questions, please contact Pulsant Technical Support

Pulsant is aware of an active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system. The attacker can then use that account to gain control of the affected system.

Pulsant are currently investigating all client and internal devices to determine exposure, prioritise risk reduction activities and remediation of CISCO advisory of "work-around". Please be aware that there is no vendor "patch" at this time.

Pulsant will provide further updates as appropriate, where any exposures are detected, Pulsant will contact impacted parties without delay.

For further information see:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z