Honeypot captures suspected Cisco IOS exploit attempt from RootEvidence scanner
VULNERABILITYCVE-2023-20198redteam/daily · 1 source
- Severity
- Medium
- Exploited
- Yes
- Sources
- 1
What happened
Honeypot telemetry recorded a POST to /%77ebuiwsmahttps on port 8000 carrying a WSMA execCLI SOAP payload that runs 'uname -a' using the admin account, with a placeholder password. The researcher suspects CVE-2023-20198 but the article does not confirm it. The User-Agent was RootEvidence/1.0, which sent Opt-Out-Email and Opt-Out-Url headers and URL-encoded the 'w' in the path. Defenders should check whether their Cisco IOS management interfaces are exposed and review logs for requests to this path.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check logs for POST requests to the path /%77ebuiwsmahttps on port 8000.
- Confirm whether any Cisco IOS management interfaces are reachable from the internet.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
SANS Internet Storm Center