Vulnerabilities · 18h ago

RootEvidence scanner probes an older Cisco IOS flaw

SANS Internet Storm Center researcher Johannes Ullrich captured one request on a honeypot whose User-Agent identified RootEvidence, apparently probing a Cisco IOS endpoint associated with CVE-2023-20198, a flaw disclosed in 2023. Ullrich called the activity nothing new; the capture does not report a successful compromise.

The request used the path `/%77ebui_wsma_https`, where `%77` represents the letter “w,” and carried a SOAP command asking for `uname -a`. Ullrich speculated that simplistic web filters might treat the encoded path differently from its ordinary spelling, but the capture does not show a filter being bypassed or the command running. The request also included opt-out email and URL headers identifying the scanner.

For teams monitoring Cisco management interfaces, this is evidence of scanning, not a standalone indicator of compromise. The honeypot record cannot establish whether any real target was vulnerable or affected.

CVE-2023-20198

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. EPSS 100% (100th percentile).

CISA federal remediation date Oct 20 · date passed

Timeline

Nov 5 Reported by SANS ISC
Oct 20 CISA federal deadline for CVE-2023-20198 passed
Oct 16 CVE-2023-20198 added to CISA KEV

Sources

1 source covering this story

SANS ISC Nov 5
Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers
Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, Author: Johannes Ullrich

Entities

CVE-2023-20198

Vendor digest: Cisco

Part of the PlainSec briefing for 2026-11-06

Editions

Briefing for 2026-11-06

Vulnerabilities · 18h agoRootEvidence scanner probes an older Cisco IOS flawSANS Internet Storm Center researcher Johannes Ullrich captured one request on a honeypot whose User-Agent identified RootEvidence, apparently probing a Cisco IOS endpoint associated with CVE-2023-20198, a flaw disclosed in 2023. Ullrich called the activity nothing new; the capture does not report a successful compromise.The request used the path `/%77ebui_wsma_https`, where `%77` represents the letter “w,” and carried a SOAP command asking for `uname -a`. Ullrich speculated that simplistic web filters might treat the encoded path differently from its ordinary spelling, but the capture does not show a filter being bypassed or the command running. The request also included opt-out email and URL headers identifying the scanner.For teams monitoring Cisco management interfaces, this is evidence of scanning, not a standalone indicator of compromise. The honeypot record cannot establish whether any real target was vulnerable or affected.

CVE-2023-20198

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. EPSS 100% (100th percentile).