Australia warns of BadCandy infections on unpatched Cisco devices

**Overview:** The Australian Signals Directorate warns of active mass exploitation of CVE-2023-20198 in Cisco IOS XE devices by attackers deploying the BadCandy webshell to obtain root access; ASD reports over 400 devices potentially compromised and more than 150 still infected as of October 2025, with evidence of repeated re-infection and suspected state-sponsored involvement (Salt Typhoon). Administrators are urged to apply Cisco patches, follow hardening guidance, and coordinate incident response and notifications.