ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 16, 2023 · ZeroDay Catalog

    Cisco IOS XE Web UI Privilege Escalation Vulnerability Discovered

    Cisco has identified a critical privilege escalation vulnerability in the IOS XE Web UI, allowing attackers to gain unauthorized access and escalate privileges.

    What changed

    Cisco has reported a significant vulnerability in the web UI of Cisco IOS XE Software, which has been actively exploited by attackers. This vulnerability allows an unauthorized user to escalate privileges and gain root access.

    The investigation revealed that attackers first exploited CVE-2023-20198 to create a local user account, which was then used to elevate privileges to root, enabling full control over the affected system.

    Who is affected

    Organizations utilizing Cisco IOS XE Software are at risk due to this vulnerability. The following groups are particularly vulnerable:

    Network administrators and IT teams managing Cisco devices should be aware of the potential for exploitation.

    • Cisco IOS XE Software users
    • Enterprise networks relying on Cisco hardware
    • Organizations with exposed web UI features in their network infrastructure

    What to do

    It is crucial for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Cisco has provided an update and a list of fixed releases.

    Administrators should utilize the Software Checker tool to ensure their systems are updated and secure.

    • Review and apply the latest security updates from Cisco.
    • Monitor network activity for any signs of unauthorized access.
    • Consider implementing additional security measures, such as restricting access to the web UI.

    Original report