Critical Privilege Escalation in Cisco IOS XE Web UI (CVE‑2023‑20198) Allows Unauthenticated Creation of Admin Account
What It Is — Cisco IOS XE’s web‑based management interface contains a flaw that lets a remote, unauthenticated attacker create a new user with privilege‑level 15 (full admin) rights.
Exploitability — The vulnerability is publicly disclosed (CVE‑2023‑20198) and can be exploited without credentials; proof‑of‑concept code is available. CVSS v3.1 scores it at 9.8 (Critical).
Affected Products — Cisco IOS XE releases that expose the Web UI (all versions prior to the Cisco‑issued patch released March 2023).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that privileged‑account provisioning controls are enforced and logged.
- Highlights gaps in evidence collection for “least‑privilege” and “segregation of duties” controls that auditors demand across frameworks (e.g., NIST CSF 2.0).
- Shows why enterprises must maintain an auditable trail of account‑creation events to prove due‑diligence in supply‑chain risk assessments.
Recommended Actions
- Apply Cisco’s security advisory patch for CVE‑2023‑20198 immediately.
- Review and tighten Web UI access: restrict to trusted IP ranges, enforce MFA for all administrative logins.
- Enable detailed logging of account‑creation events and integrate them with a SIEM for continuous monitoring.
- Conduct a privileged‑access review to ensure no unauthorized accounts exist post‑remediation.
Source: CISA KEV – CVE‑2023‑20198