Honeypot captures suspected Cisco IOS exploit attempt from RootEvidence scanner
VULNERABILITYCVE-2023-20198redteam/daily · 1 source
- Severity
- Medium
- Exploited
- Yes
- Sources
- 1
What happened
A SANS Internet Storm Center honeypot logged a SOAP-based POST request to a Cisco IOS web management path, which the researcher suspects targets CVE-2023-20198. The request used the admin username with a placeholder password and attempted to run uname -a. The User-Agent was RootEvidence/1.0, a vulnerability management platform that includes Opt-Out-Email and Opt-Out-Url headers.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check logs for POST requests to the path /%77ebuiwsmahttps on port 8000.
- Confirm whether any Cisco IOS management interfaces are reachable from the internet.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
SANS Internet Storm Center