Is CVE-2023-20198 being actively exploited?

Yes. CVE-2023-20198 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on October 16, 2023.

What is the CVSS score for CVE-2023-20198?

CVE-2023-20198 has a CVSS 3.1 base score of 10.0 (CRITICAL).

CVE-2023-20198

CRITICAL · CVSS 10.0CISA KEV: actively exploitedEPSS 99.6%EU EUVD: exploited

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

Key facts

CVSS score: 10.0 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-420
EPSS score: 99.6% (100th percentile)
In CISA KEV: Yes, added October 16, 2023
In EU EUVD: Yes (EUVD-2023-24377)
Published: October 16, 2023
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Cisco IOS XE Web UI Privilege Escalation Vulnerability

Added to the KEV catalog on October 16, 2023; federal remediation due October 20, 2023.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2023-24377 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

cisco / ios xe
rockwellautomation / allen-bradley stratix 5200
rockwellautomation / allen-bradley stratix 5200 firmware
rockwellautomation / allen-bradley stratix 5800
rockwellautomation / allen-bradley stratix 5800 firmware

Certified products that may be affected

5 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Catalyst 9800 (40/80/L) Wireless Controllers running IOS-XE 16.12 - Cisco Systems, Inc. - FIPS 140 4606 - historical
Cisco Aironet 1562e/i/d/ps, 2802e/i, 3802e/i/p, 4800 and IW6300H- AC/DC/DCW Wireless LAN Access Points, AireOS Version 8.10MR3 and IOS-XE 17.3 - Cisco Systems, Inc. - FIPS 140 4129 - historical
Cisco Aggregation Services Router 1000 Series (ASR1K), Cisco Cloud Services Router 1000V (CSR1000V), Cisco Integrated Services Router 1100 Series (ISR1100), Cisco Integrated Services Router 4200 Series (ISR4K) running IOS-XE 17.3 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11186-2021 - archived
Cisco Catalyst Industrial Ethernet 3x00 Rugged Series (IE3200, IE3300, IE3400, IE3400H) Switches running IOS-XE 17.3 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11177-2021 - archived
Cisco Catalyst 9800 (40/80/L) Wireless Controllers running IOS-XE 16.12 - Cisco Systems, Inc. - FIPS 140 3883 - historical

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z(Mitigation, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain