RootEvidence scanner probes an older Cisco IOS flaw
SANS Internet Storm Center researcher Johannes Ullrich captured one request on a honeypot whose User-Agent identified RootEvidence, apparently probing a Cisco IOS endpoint associated with CVE-2023-20198, a flaw disclosed in 2023. Ullrich called the activity nothing new; the capture does not report a successful compromise.
The request used the path `/%77ebui_wsma_https`, where `%77` represents the letter “w,” and carried a SOAP command asking for `uname -a`. Ullrich speculated that simplistic web filters might treat the encoded path differently from its ordinary spelling, but the capture does not show a filter being bypassed or the command running. The request also included opt-out email and URL headers identifying the scanner.
For teams monitoring Cisco management interfaces, this is evidence of scanning, not a standalone indicator of compromise. The honeypot record cannot establish whether any real target was vulnerable or affected.
CVSS 10 CRITICAL: cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. EPSS 100% (100th percentile).
CISA federal remediation date Oct 20 · date passed