Cisco IOS XE Privilege Escalation (CVE-2023-20198) – Cato’s analysis and mitigation

**Executive Summary:** Cisco published an advisory for a critical (CVSS 10) zero-day vulnerability in IOS XE Web UI (CVE-2023-20198) that was actively exploited to gain unauthenticated administrative access; a follow-on vulnerability (CVE-2023-20273) could be used to escalate to root and install implants. Exploitation occurred prior to available patches, many devices were likely impacted, and Cato deployed IPS signatures and provided mitigation recommendations (disable HTTP/S Web UI access and restrict management access).