Search — “RootEvidence/1.0”
1 story · 0 IoCs
Stories
P2
Honeypots observe scans probing Cisco IOS XE WSMA interface for CVE-2023-20198; no confirmed compromises reported
SANS ISC observed POST requests to the Cisco IOS XE WSMA endpoint on port 8000 from a vulnerability-management scanner identifying itself as RootEvidence/1.0, with a SOAP body running 'uname -a' as admin. The handler suspects the probes target CVE-2023-20198 and notes the scanner sends Opt-Out headers. Hunters should look for requests to /%77ebui_wsma_https on port 8000 and keep the web UI off the internet.