Cisco IOS XE Web UI: Implant and Rogue Admin (CVE-2023-20198)

The edge router management interface was reachable from the public internet. Before examining the exploit chain, establish the exact TCP port that was exposed.

Two external addresses from the same subnet probed the router before anything was written to the device. One performed reconnaissance only; the other triggered account creation. Identify the exploit source.

The first exploit stage created a privileged local account on the device without any legitimate administrator action. Identify the account name from the device logs.

After account creation, the attacker used a second exploit to write a persistent file to the router filesystem. Name the implant file from the device logs.

The implant embedded in the router HTTP server provides the attacker with durable access that survives configuration restarts. Map the persistence mechanism to its MITRE ATT&CK technique identifier.

Once installed, the implant initiated outbound contact to confirm persistence and receive tasking. Identify the external C2 IP address it contacted.