Full Report
Cybersecurity authorities are raising urgent alarms as threat actors continue to exploit a critical vulnerability in Cisco IOS XE devices, deploying a malicious implant known as BADCANDY across networks worldwide. The Australian Signals Directorate (ASD) has confirmed that over 150 devices remain compromised in Australia alone as of late October 2025, despite ongoing remediation efforts […] The post Cisco IOS XE Vulnerability Being Abused in the Wild to Plant BADCANDY appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Analysis Summary
# Vulnerability: Cisco IOS XE Remote Privilege Escalation (BADCANDY Implant)
## CVE Details
- CVE ID: CVE-2023-20198 (Inferred based on the description linking BADCANDY to an exploit that allows creating privileged accounts on IOS XE)
- CVSS Score: Critical (Score not explicitly provided, but context indicates "critical vulnerability")
- CWE: Unspecified (Likely related to improper authorization or authentication)
## Affected Systems
- Products: Cisco IOS XE Software (devices utilizing the web user interface)
- Versions: Any version vulnerable prior to patching.
- Configurations: Devices exposing the web user interface to attacker access.
## Vulnerability Description
The vulnerability in Cisco IOS XE allows remote, unauthenticated attackers to create highly privileged accounts (privilege level 15) on vulnerable devices by exploiting flaws within the web user interface capability. This initial compromise is leveraged to deploy the BADCANDY malicious implant (a Lua-based web shell).
## Exploitation
- Status: Exploited in the wild
- Complexity: Low (Implied by "unauthenticated attackers" gaining privilege)
- Attack Vector: Network (Exploitation occurs over the exposed web interface)
## Impact
- Confidentiality: High (Ability to harvest credentials and establish long-term access)
- Integrity: High (Ability to establish privileged accounts and alter configurations)
- Availability: Medium (Implied risk from established access, though BADCANDY itself is non-persistent)
## Remediation
### Patches
- Specific patches are not detailed in the summary but are required releases from Cisco addressing CVE-2023-20198. Organizations must apply all relevant updates.
### Workarounds
1. **Disable Web UI:** If possible, ensure the Cisco IOS XE web user interface is not exposed to external or untrusted network traffic.
2. **Review Configuration:** Immediately review running configurations for the presence of suspicious, high-privilege accounts (Privilege 15), specifically looking for names like: `cisco_tac_admin`, `cisco_support`, `cisco_sys_manager`, or random character strings. Remove any unauthorized accounts found.
3. **Audit Logging:** Examine TACACS+ AAA command accounting logs for evidence of unauthorized configuration changes.
4. **Inspect Interfaces:** Review configurations for unknown tunnel interfaces.
## Detection
- **Indicators of Compromise (IOCs):**
- Presence of the BADCANDY implant (Note: This implant is non-persistent and may be removed upon reboot).
- Existence of newly created, unauthorized privilege 15 accounts with suspicious naming conventions.
- **Detection Methods and Tools:**
- Forensically examine configurations for newly created accounts and interfaces.
- Monitor AAA logs for suspicious command execution related to account creation or configuration modification.
- Threat actors appear to detect when the implant is removed, suggesting active monitoring for remediation attempts; a full remediation (patching + cleanup) is critical.
## References
- Vendor advisories: Cisco Advisories pertaining to CVE-2023-20198 (Search Cisco Security Advisories for IOS XE).
- Relevant links - defanged: gbhackers dot com/cisco-ios-xe-vulnerability-3/