CISA Updates Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities

Summary

The Cisco Security Advisory provides guidance on the updated mitigation steps to address two vulnerabilities affecting Cisco’s Internetwork Operating System (IOS) and Web User Interface (UI). The vulnerabilities, CVE-2023-20198 and CVE-2023-20273, have been fixed in the latest software release.

The Cisco Internet Security Association (CISA) urges organizations to immediately update their Cisco IOS XE Software to the latest release train to address these vulnerabilities. The advisory also notes that the vulnerabilities are still present in some Cisco devices, specifically the Catalyst 3650 and 3850.

CISA’s updated guidance recommends that organizations review their Cisco IOS XE Software Web UI Feature to ensure the vulnerabilities are properly remediated. The agility is also recommended to review its Known Exploited Vulnerabilities Catalog, which includes the updated information on the vulnerabilities.

It is worth noting that the Cisco Talos blog has reported active exploitation of these vulnerabilities and recommends that organizations take immediate action to mitigate the risks.

Key Takeaways:

1. Cisco has fixed the vulnerabilities in the latest software release.
2. Organizations are urged to update their Cisco IOS XE Software immediately.
3. Review of Cisco IOS XE Software Web UI Feature is recommended to ensure vulnerabilities are properly remediated.
4. CISA’s Known Exploited Vulnerabilities Catalog should be reviewed for updated information.
5. Cisco Talos blog reports active exploitation of these vulnerabilities, emphasizing the need for immediate action.