Search — “CVE-2023-20198”

SANS ISC observed POST requests to the Cisco IOS XE WSMA endpoint on port 8000 from a vulnerability-management scanner identifying itself as RootEvidence/1.0, with a SOAP body running 'uname -a' as admin. The handler suspects the probes target CVE-2023-20198 and notes the scanner sends Opt-Out headers. Hunters should look for requests to /%77ebui_wsma_https on port 8000 and keep the web UI off the internet.

Cisco Talos IR's Q3 2026 trends report finds phishing (37%) and public-facing app exploitation (33%) led initial access; actors impersonated IT help desks via vishing to get victims to start Quick Assist/RMM sessions. VYPR ransomware operators used RMM-launched PowerShell to download an MSI, then MeshAgent, Rclone, PsExec and BYOVD to kill EDR; Interlock actors tried uninstalling Cisco Secure Endpoint, used taskkill/PsExec, disabled Defender and cleared logs. Salt Typhoon-linked actors exploited CVE-2023-20198 in web-based management interfaces, deploying BadCandy, creating privileged accounts and disabling logging. Hunt for Quick Assist sessions followed by RMM-spawned PowerShell/msiexec, taskkill against security processes, loads of known-vulnerable drivers, and new privileged accounts on network devices.