CISA Updates Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities With Additional Releases

Summary:

The Cybersecurity and Infrastructure Security Agency (CISA) has updated its guidance regarding two vulnerabilities affecting Cisco's Internetworking Operating System (IOS) XE Software Web User Interface (UI). The vulnerabilities, CVE-2023-20198 and CVE-2023-20273, have been fixed for the 17.6 software release train with the 17.6.6a update, while fixes are still pending for release trains 17.3 and 16.12. CISA urges organizations to immediately update to the fixed releases and review relevant guidance and advisories to mitigate the risks. Furthermore, CISA has added the vulnerabilities to its Known Exploited Vulnerabilities Catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate them by the specified due date to protect FCEB networks against active threats.