Cisco IOS XE Web UI Persistent Implant (CVE-2024-20399)

CVE-2024-20399 allows authenticated attackers to install persistent implants on Cisco IOS XE devices via the Web UI. Survives reboots when chained with CVE-2023-20198 — CISA KEV, critical for edge routers and switches.

Affected IOS XE

• IOS XE with Web UI enabled (same exposure as CVE-2023-20198)
• ISR, ASR, Catalyst 9000 series on vulnerable trains
• Devices already compromised may retain implant after partial patch

Check for implant before patching

show version
show platform software fed active install package integrity 2>/dev/null
# Cisco PSIRT IOC — check for bad.lemonade / malicious Lua

Patching Method

1. Run Cisco PSIRT compromise detection script from advisory first.
2. If compromised: factory reset or Cisco TAC recovery before patching.
3. Download IOS XE image with both 20198 and 20399 fixes from Software Central.
4. Backup config: copy running-config flash:backup.cfg
5. Install fixed image; full reload required.
6. After reboot: no ip http server and no ip http secure-server
7. Rotate all credentials; rebuild AAA from clean template.

show version | include Version
show running-config | include http
show logging | include LOGIN

Post-patch hardening

• Disable Web UI permanently if SSH/NETCONF suffices
• Restrict management plane to out-of-band network
• Monitor Cisco PSIRT for updated IOCs monthly