VULNpocalypse
LowVulnerabilityMonitoring

SANS ISC reports scans it suspects target Cisco IOS CVE-2023-20198

SANS ISC reports honeypot scans it suspects target Cisco IOS CVE-2023-20198; check that IOS web management is not exposed to the internet.

Published
Exploitation
No confirmed compromise, SANS ISC reports scan attempts against its honeypots only

Live scores

CVE-2023-20198
EPSS
0.996
very likely to be attacked soon
VEDAS
0.981
strong exploit evidence
On CISA KEV
Yes, since 2023-10-16
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.1CVE-2023-20198 EPSS over time2025-042026-11-04
VEDAS (exploit evidence)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.5CVE-2023-20198 VEDAS over time2025-042026-11-04

Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish.

What happened

SANS Internet Storm Center handler Johannes Ullrich reports that ISC honeypots received requests he describes as Cisco IOS exploit attempts. He says he “suspects” they target CVE-2023-20198, an older vulnerability, and calls the activity “still nothing new” (SANS ISC).

According to SANS ISC, the request was an HTTP POST to the path /%77ebui_wsma_https. In that path the letter “w” in “webui” is URL-encoded. The body was a SOAP message that tried to run the command uname -a with the username “admin” (SANS ISC). Ullrich says he expects that some web application firewalls may be fooled by the URL encoding.

SANS ISC also notes that the request used the User-Agent “RootEvidence/1.0” and carried “Opt-Out-Email” and “Opt-Out-Url” headers. The opt-out URL points to rootevidence.com. Ullrich describes RootEvidence as an exposure and vulnerability management platform. He says he could not find a standard that defines these headers and that this is the first time he has noticed them. He adds that RootEvidence has used them since December of the previous year (SANS ISC).

The following points are not confirmed by the source:

  • That the requests target CVE-2023-20198. Ullrich states this as a suspicion.
  • Any successful compromise of real devices.
  • Affected IOS versions and fixed releases.

Am I affected?

  • The SANS ISC diary does not list affected or fixed versions. Those details are not confirmed here. See the NVD record for CVE-2023-20198.
  • The observed requests target the webui_wsma_https path on the IOS web interface (SANS ISC). Devices whose web management interface is not reachable from untrusted networks would not receive this kind of request.

What to do now

  1. Check the NVD record for CVE-2023-20198 to find out which IOS versions are affected and where the vendor guidance is.
  2. Identify any Cisco IOS devices whose web management interface is reachable from the internet, and restrict that access.
  3. If you rely on a WAF or filter to block this path, test that it also matches the URL-encoded form /%77ebui_wsma_https, as described by SANS ISC.
  4. Review web server or device logs for POST requests to webui_wsma_https paths.

Sources