[HIGH PRIORITY] Cisco IOS XE Web UI Privilege Escalation Implant (CVE-2023-20198)

⚠ HIGH PRIORITY — CISA KEV. CVE-2023-20198 is an unauthenticated privilege escalation in Cisco IOS XE Web UI. Attackers create persistent bad.lemonade implants on routers and switches — one of the largest network device compromises of 2023–2024.

Affected Cisco IOS XE

• IOS XE with Web UI feature enabled (ip http server / secure-server)
• Enterprise edge routers, branch ISR, Catalyst switches running IOS XE
• Internet-exposed management on port 443/80

Check for compromise before patching

show version | include IOS XE
show ip http server status
show running-config | include http
# Hunt implant (Cisco PSIRT guidance):
show webui log | include unauthorized

Patching Method

1. Detect implant first — run Cisco PSIRT IOC checks before upgrade.
2. Download fixed IOS XE image from Cisco Software Central for your hardware model.
3. Backup config: copy running-config flash:backup-pre-patch.cfg
4. Install fixed image via install add file / ISSU or traditional reload method.
5. After reboot, verify Web UI disabled or patched version per advisory.
6. Rotate enable secrets, SNMP communities, and AAA credentials.

show version
show inventory
show running-config | include username
no ip http server
no ip http secure-server

Post-patch hardening

• Disable HTTP/HTTPS Web UI if not required: no ip http secure-server
• Use out-of-band management (VPN/SSH only) for device admin
• Also patch CVE-2024-20399 if persistent implant variant detected