# Scans probe old Cisco IOS XE flaw CVE-2023-20198

Published: 2026-11-05 · Severity: elevated · Sectors: Infrastructure
Canonical: https://vorant.io/reports/a652f7cc-6289-5bb0-a92e-9ea726251d47/scans-probe-old-cisco-ios-xe-flaw-cve-2023-20198
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> A SANS ISC honeypot captured vulnerability scanner traffic probing for the 2023 Cisco IOS XE web UI flaw, using WSMA command execution and new opt-out headers.

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33492

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2023-20198 as exploited in the wild.

SANS Internet Storm Center researcher Johannes Ullrich observed honeypot traffic containing a probe attempt likely targeting CVE-2023-20198, a privilege-escalation vulnerability in Cisco IOS XE's web UI feature disclosed in late 2023. The request abused the WSMA (Web Services Management Agent) exec interface to attempt execution of the 'uname -a' command via a SOAP XML request, with the target path URL-encoded (%77 for 'w') potentially to evade weak WAF filtering rules.

The notable finding is not new exploitation but the presence of 'Opt-Out-Email' and 'Opt-Out-Url' HTTP headers identifying the scanning entity as RootEvidence, a commercial exposure/vulnerability management platform. Ullrich notes this is the first time he has observed such opt-out headers in scan traffic, and that RootEvidence has reportedly used them since December of the prior year. No standard appears to define this header convention. This activity represents benign/commercial internet-wide scanning rather than malicious exploitation, though defenders should be aware such traffic exists on sensors and may be confused with actual attack attempts against unpatched IOS XE devices.

Defenders running Cisco IOS XE devices with the web UI feature exposed should ensure CVE-2023-20198 patches and mitigations (disabling the HTTP/HTTPS server feature if not required) are applied, and should expect to see recurring scanner traffic probing this known vulnerability from various research and commercial vulnerability-scanning services.

## Mentioned in this report

- Vulnerabilities: CVE-2023-20198 (KEV)

## Detection guidance (public sample)

### Cisco IOS XE WSMA Exec Interface Request (CVE-2023-20198 Probe)

ATT&CK: T1595

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

POST requests to the Cisco IOS XE WSMA endpoint (webui_wsma_http/https), used to run CLI commands through SOAP XML in CVE-2023-20198 probing and exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco IOS XE WSMA Exec Interface Request (CVE-2023-20198 Probe)
description: Detects POST requests to the Cisco IOS XE Web Services Management Agent
  endpoint (webui_wsma_http / webui_wsma_https). Scanners and attackers use it to
  submit SOAP XML exec requests such as 'uname -a' when probing CVE-2023-20198. Matches
  the endpoint and method, not scanner-specific headers or source addresses. Commercial
  scanners such as RootEvidence also trigger it, so triage on whether the target is
  a real, exposed IOS XE device.
tags:
- attack.reconnaissance
- attack.t1595
- attack.execution
- attack.t1059
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: webui_wsma_http
  condition: selection
falsepositives:
- Authorised network automation or management tooling that uses WSMA on IOS XE devices
- Commercial or research internet scanners probing exposed devices
level: medium
tags_extra: []
id: 35e44016-3841-5e65-9cee-7e2c7ed6153f
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33492
```

### Cisco IOS XE WSMA Request With URL-Encoded Path Obfuscation

ATT&CK: T1059

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Requests to the IOS XE WSMA path where the leading 'w' is percent-encoded (%77 or double-encoded %2577), an evasion trick seen in CVE-2023-20198 probes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco IOS XE WSMA Request With URL-Encoded Path Obfuscation
description: Detects requests to the Cisco IOS XE WSMA exec endpoint where the path
  is URL-encoded (%77ebui_wsma, or double-encoded %2577ebui_wsma). This likely tries
  to bypass weak WAF or filter rules while attempting command execution, as in CVE-2023-20198
  probes. Legitimate clients have no reason to encode this path.
tags:
- attack.reconnaissance
- attack.t1595
- attack.execution
- attack.t1059
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - '%77ebui_wsma'
    - '%2577ebui_wsma'
  condition: selection
falsepositives:
- Vulnerability scanners that deliberately send encoded paths against IOS XE devices
level: high
id: e41226d2-4f1b-55d6-aa90-4eebdf6bef36
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33492
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: an indicator rule with Sigma, Splunk SPL, and Elastic. A free account opens it.

Source reporting: https://isc.sans.edu/diary/rss/33492

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a652f7cc-6289-5bb0-a92e-9ea726251d47/scans-probe-old-cisco-ios-xe-flaw-cve-2023-20198.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup