Cisco IOS XE Zero-Day CVE-2023-20198 Hack Revealed

This report describes active exploitation of CVE-2023-20198, a critical zero-day in the Cisco IOS XE web UI (CVSS 10.0) that allows unauthenticated remote attackers to create privileged accounts and deploy a Lua implant enabling arbitrary command execution. Cisco and Cyble observed exploitation in the wild, documented IoCs (malicious IPs, POST requests with "menu"/"logon_hash" parameters), and recommend disabling the HTTP server feature (no ip http server / no ip http secure-server), applying access controls, and monitoring logs; Snort rules and scanning tools are also provided.