Weathering the storm: In the midst of a Typhoon
blog.talosintelligence.com · 20 Feb 2025 · Licence: not cleared; local research copy only
CVEs this report names
4 CVEs- CVE-2023-20198Cisco IOS XE Web UI Privilege Escalation VulnerabilityCisco · IOS XE Web UIKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1136Create Account2 reports99.6%Top 0.05%86.1priority
- CVE-2018-0171Cisco IOS and IOS XE Software Smart Install Remote Code Execution VulnerabilityCisco · IOS and IOS XEKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services+1 more · 2 reports99.5%Top 0.06%76.0priority
- CVE-2023-20273Cisco IOS XE Web UI Command Injection VulnerabilityCisco · Cisco IOS XE Web UIKEVPublic exploitHigh · 7.2T1078Valid AccountsT1059Command and Scripting Interpreter+1 more · 2 reports92.9%Top 0.17%74.1priority
- CVE-2024-20399Cisco NX-OS Command Injection VulnerabilityCisco · NX-OSKEVPublic exploitMedium · 6.7T1078Valid AccountsT1059Command and Scripting Interpreter3 reports4.3%Top 8.9%73.7priority
Where it names them
CVE-2023-20198 Original (opens in a new tab) ↗
CVE-2023-20198, CVE-2023-20273 - Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature (Last Updated: 1-Nov-2023)
CVE-2018-0171 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
There was only one case in which we found evidence suggesting that a Cisco vulnerability (CVE-2018-0171) was likely abused.
CVE-2018-0171 - Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (Last Updated: 15-Dec-2022)
During this investigation, we also observed additional pervasive targeting of Cisco devices with exposed Smart Install (SMI) and the subsequent abuse of CVE-2018-0171, a vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE software.
Legacy devices with known vulnerabilities, such as Smart Install (CVE-2018-0171), should be patched or decommissioned if no longer in use.
CVE-2023-20273 Original (opens in a new tab) ↗
CVE-2023-20198, CVE-2023-20273 - Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature (Last Updated: 1-Nov-2023)
CVE-2024-20399 Original (opens in a new tab) ↗
CVE-2024-20399 - Cisco NX-OS Software CLI Command Injection Vulnerability (Last Updated: 17-Sep-2024)
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.