Scans probe old Cisco IOS XE flaw CVE-2023-20198
A SANS ISC honeypot captured vulnerability scanner traffic probing for the 2023 Cisco IOS XE web UI flaw, using WSMA command execution and new opt-out headers.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-20198 as exploited in the wild.
SANS Internet Storm Center researcher Johannes Ullrich observed honeypot traffic containing a probe attempt likely targeting CVE-2023-20198, a privilege-escalation vulnerability in Cisco IOS XE's web UI feature disclosed in late 2023. The request abused the WSMA (Web Services Management Agent) exec interface to attempt execution of the 'uname -a' command via a SOAP XML request, with the target path URL-encoded (%77 for 'w') potentially to evade weak WAF filtering rules.
The notable finding is not new exploitation but the presence of 'Opt-Out-Email' and 'Opt-Out-Url' HTTP headers identifying the scanning entity as RootEvidence, a commercial exposure/vulnerability management platform. Ullrich notes this is the first time he has observed such opt-out headers in scan traffic, and that RootEvidence has reportedly used them since December of the prior year. No standard appears to define this header convention. This activity represents benign/commercial internet-wide scanning rather than malicious exploitation, though defenders should be aware such traffic exists on sensors and may be confused with actual attack attempts against unpatched IOS XE devices.
Defenders running Cisco IOS XE devices with the web UI feature exposed should ensure CVE-2023-20198 patches and mitigations (disabling the HTTP/HTTPS server feature if not required) are applied, and should expect to see recurring scanner traffic probing this known vulnerability from various research and commercial vulnerability-scanning services.
Mentioned in this report
Detection guidance
Cisco IOS XE WSMA Exec Interface Request (CVE-2023-20198 Probe)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
POST requests to the Cisco IOS XE WSMA endpoint (webui_wsma_http/https), used to run CLI commands through SOAP XML in CVE-2023-20198 probing and exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco IOS XE WSMA Exec Interface Request (CVE-2023-20198 Probe)
description: Detects POST requests to the Cisco IOS XE Web Services Management Agent
endpoint (webui_wsma_http / webui_wsma_https). Scanners and attackers use it to
submit SOAP XML exec requests such as 'uname -a' when probing CVE-2023-20198. Matches
the endpoint and method, not scanner-specific headers or source addresses. Commercial
scanners such as RootEvidence also trigger it, so triage on whether the target is
a real, exposed IOS XE device.
tags:
- attack.reconnaissance
- attack.t1595
- attack.execution
- attack.t1059
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: webui_wsma_http
condition: selection
falsepositives:
- Authorised network automation or management tooling that uses WSMA on IOS XE devices
- Commercial or research internet scanners probing exposed devices
level: medium
tags_extra: []
id: 35e44016-3841-5e65-9cee-7e2c7ed6153f
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33492
Cisco IOS XE WSMA Request With URL-Encoded Path Obfuscation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Requests to the IOS XE WSMA path where the leading 'w' is percent-encoded (%77 or double-encoded %2577), an evasion trick seen in CVE-2023-20198 probes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco IOS XE WSMA Request With URL-Encoded Path Obfuscation
description: Detects requests to the Cisco IOS XE WSMA exec endpoint where the path
is URL-encoded (%77ebui_wsma, or double-encoded %2577ebui_wsma). This likely tries
to bypass weak WAF or filter rules while attempting command execution, as in CVE-2023-20198
probes. Legitimate clients have no reason to encode this path.
tags:
- attack.reconnaissance
- attack.t1595
- attack.execution
- attack.t1059
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- '%77ebui_wsma'
- '%2577ebui_wsma'
condition: selection
falsepositives:
- Vulnerability scanners that deliberately send encoded paths against IOS XE devices
level: high
id: e41226d2-4f1b-55d6-aa90-4eebdf6bef36
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33492
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, and Elastic. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33492
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs