Cisco IOS XE CVE-2023-20198 Check

Hello, 

Cisco rececently annouced CVE-2023-20198 with a CVSS critical rated vulnerability for IOS XE systems with a hardcoded default password in the web gui. There is no fix available.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

Companies need to ensure this feature is set to OFF. Even with the rapid advisory, it takes security companies and aggregators a little bit of time to input new external data into the database, ourselves included. 

But maybe you need to know right now. The good news is that we already have the data, we just need to do a quick check. Check out the following NQE that you can search right now

 

/* CVE-2023-20198 NQE check 
   16OCT2023 
   ForwardNetworks Community Portal
*/

http = `ip http server`;

http_active_none = `ip http active-session-modules none`;

https = `ip http secure-server`;

https_active_none = `ip http secure-active-session-modules none`;

foreach d in network.devices
where d.platform.os == OS.IOS_XE
let config_http = patternMatches(d.files.config, http)
let config_http_active_none = patternMatches(d.files.config, http_active_none)
let config_https = patternMatches(d.files.config, https)
let config_https_active_none = patternMatches(d.files.config, https_active_none)
where length(config_http) != 0 && length(config_http_active_none) == 0 ||
      length(config_https) != 0 && length(config_https_active_none) == 0 
select {
  cve: "CVE-2023-20198 Found",
  name: d.platform.managementIps,
  os: d.platform.os,
  config_http,
  config_http_active_none,
  config_https,
  config_https_active_none
}