Cisco IOS XE Web UI: The Mass-Implant Campaign on Core Networks

Cisco IOS XE runs enterprise routers, switches and wireless controllers; its HTTP/HTTPS Web UI is an administrative console that, when exposed to untrusted networks, becomes a direct, pre-authentication attack surface on core network infrastructure. In October 2023 a pair of flaws — CVE-2023-20198 (a privilege-escalation/authentication bypass) chained with CVE-2023-20273 (command injection to root) — drove a mass-exploitation campaign that created rogue privileged accounts and dropped Lua webshell implants on tens of thousands of devices. Exploitation has continued into 2025.

Key Exploited CVEs

T1190 T1136 T1505.003

Scale & 2025 Activity

Early scan-based reporting cited an upper bound of “over 50,000” compromised IOS XE devices (LeakIX estimated 30,000+ exposed). The visible count then fell to a few hundred — attributed by researchers to the attackers altering the implant to evade a fingerprinting scan, i.e. evasion rather than cleanup, so treat the lower number with caution. In 2025, Australia’s ASD/ACSC (“Don’t take BADCANDY from strangers,” October 2025) reported ongoing exploitation of CVE-2023-20198 to deploy the BADCANDY Lua web shell. Some 2025 Cisco-edge scanning has been loosely associated in reporting with Salt Typhoon, but public sources explicitly did not attribute it — treat that link as tentative.

Detection & Mitigation

• Patch to fixed IOS XE releases per Cisco’s advisory.
• Disable the HTTP server feature (no ip http server / no ip http secure-server) where not required; never expose the Web UI to the internet — restrict it to a management VLAN or by ACL.
• Hunt for unexpected new local privileged (priv-15) accounts and run Cisco’s published implant check (a crafted request returning a hex token).
• The implant is non-persistent, so a reboot removes it but does not fix the flaw — patch to prevent re-exploitation, re-scan after removal, and treat any previously-exposed device as suspect even if its scan fingerprint is now negative.