Advisory for Cisco IOS XE HTTP/HTTPS Vulnerability (CVE-2023-20198 / BADCANDY)

Summary

This advisory is issued by Webvault for customers operating Cisco routers and platforms running IOS XE software. A critical vulnerability identified as CVE-2023-20198, nicknamed "BADCANDY", affects devices with the HTTP or HTTPS Server feature enabled. This vulnerability is currently being actively exploited in the wild.

It allows unauthenticated remote attackers to create a local user account with level 15 privileges—potentially granting full administrative control over the affected device.

This issue does not only impact C1100 routers, but any Cisco device running IOS XE 16.6.1 or later with the web UI (HTTP/HTTPS server) enabled.

Cisco Security Advisories

• Talos Intelligence Blog - Active Exploitation of Cisco IOS XE

• Cisco Official Advisory: cisco-sa-iosxe-webui-privesc-j22SaA4z

According to Cisco:

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to create an account on an affected system with privilege level 15 access. This account could then be used to gain control of the system.

The vulnerability is due to improper handling of authentication requests within the web UI feature.

Affected Software and Devices

• All Cisco IOS XE devices running 16.6.1 or later, with HTTP or HTTPS server enabled

• Example affected software:

  • c1100-universalk9_ias.16.09.08.SPA.bin (Fuji 16.9.8)

Note:

• The Fuji (16.9) train is no longer maintained and does not receive security patches.

• However, patched versions are available in both the 16.12.x (Amsterdam) and 17.x trains.

Workaround for Fuji Code (16.9.8)

If you cannot upgrade immediately, disable all web-based management services to eliminate the attack surface.

Disable HTTP/HTTPS Services

no ip http server
no ip http authentication local
no ip http secure-server

These commands will:

• Disable the standard HTTP server

• Disable local authentication for HTTP

• Disable the secure (HTTPS) server

This will prevent exploitation via the web management interface.

Additional Mitigations

Check and Remove Suspicious User Accounts

show run | include username

Remove any unauthorized users:

no username cisco_support
no username cisco_sys_manager
no username cisco_tac_admin

Restrict Management Access

• Apply ACLs to limit access to VTY lines and SSH.

• Enable logging to detect unauthorized access attempts.

Upgrade Recommendations

While the above workaround mitigates the attack vector, long-term remediation requires upgrading to a patched IOS XE release. Cisco has issued fixes in the following trains:

For devices running 16.x that cannot be upgraded to 17.x, the 16.12.x Amsterdam train offers a secure alternative that is still under maintenance.

Smart Licensing Considerations

Starting with IOS XE 16.9 and continuing into 17.x, Cisco introduces Smart Licensing. However, Smart Licensing Using Policy (SLP) is non-enforcing and allows you to run Advanced Security features without registering the device.

Recommended Post-Upgrade Configuration

If using 16.12.x or 17.x:

license smart disable
no telemetry ietf

This prevents the router from attempting to contact Cisco or register, while maintaining functionality of licensed features like Advanced Security.