Honeypot Captures Cisco IOS Scan Suspected of Targeting CVE-2023-20198
Summary
A SANS honeypot recorded a Cisco IOS WSMA request issuing `uname -a`, which the author suspects targets CVE-2023-20198. The request included RootEvidence opt-out headers and URL-encoded the “w” in its path.
Key points
- The request targeted the Cisco IOS WSMA path `/%77ebui_wsma_https` and included a SOAP command to run `uname -a`.
- The author suspects the scan was related to CVE-2023-20198; the article does not establish successful exploitation.
- The request used `Opt-Out-Email` and `Opt-Out-Url` headers, with the URL pointing to www[.]rootevidence[.]com.
- The author notes that RootEvidence had reportedly used these opt-out headers since December of the prior year.
Article Details
- Event Type
- Honeypot observation of a suspected Cisco IOS exploit scan
- Impact
- The request targeted the Cisco IOS WSMA endpoint and attempted to run `uname -a`. The author suspects it was related to CVE-2023-20198; the article does not confirm exploitation or report impact to a victim.