Description
Cisco IOS XE Web UI存在权限提升漏洞，此漏洞是由于访问控制不当导致的。
Cisco IOS XE Web UI CVE-2023-20198 权限提升漏洞 - 配置修改
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cisco.com/c/zh_cn/support/docs/ios-nx-os-software/ios-xe-17/221144-cisco-tac-technical-faqs-for-cisco-ios-x.html
https://blog.nsfocus.net/cisco-ios-xe-web-uicve-2023-20198/
https://www.venustech.com.cn/new_type/aqtg/20231023/26388.html
https://bbs.kanxue.com/article-24726.htm
https://cloud.tencent.com/developer/article/2350348
https://cn-sec.com/archives/2929639.html
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
https://nvd.nist.gov/vuln/detail/cve-2023-20198
https://www.cisa.gov/guidance-addressing-cisco-ios-xe-web-ui-vulnerabilities
https://www.rapid7.com/blog/post/2023/10/17/etr-cve-2023-20198-active-exploitation-of-cisco-ios-xe-zero-day-vulnerability/
https://www.sentinelone.com/vulnerability-database/cve-2023-20198/
https://www.cve.org/CVERecord?id=CVE-2023-20198
https://unit42.paloaltonetworks.com/threat-brief-cve-2023-20198-cisco-ios-xe/
https://its.ny.gov/2023-122
https://db.gcve.eu/vuln/cve-2023-20198
https://nic.imu.edu.cn/info/1095/1833.htm
https://isecurity.huawei.com/sec/web/viewAlert.do?id=2473
https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/information_security_information_sharing_1248/
https://github.com/G4sul1n/Cisco-IOS-XE-CVE-2023-20198