Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers

Key facts for RootEvidence Cisco WSMA scanning

Detection coverage for RootEvidence Cisco WSMA scanning

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5345 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cisco IOS XE WSMA Endpoint Probe via URL-Encoded Path (CVE-2023-20198 / RootEvidence Scan)

Detects HTTP requests to the Cisco IOS XE web UI Web Services Management Agent endpoint (webui_wsma_http/https) where the leading 'w' is URL-encoded (/%77ebui_wsma_https), the pattern SANS ISC honeypots recorded on port 8000 in November 2026 running 'uname -a' through execCLI. The encoding is likely meant to slip past string-matching WAF rules in front of CVE-2023-20198 (CVSS 10.0, CISA KEV). The rule also flags whether the request claims the self-declared RootEvidence/1.0 User-Agent, which is spoofable and must not be treated as proof of benign intent.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002, T1027, T1059.008, T1082
• Data sources: web:access_combined, web:nginx:plus:kv, web:stream:http
• Severity: medium
• Confidence: high

Splunk SPL

index=web (sourcetype=access_combined OR sourcetype=nginx:plus:kv OR sourcetype=stream:http) earliest=-24h
| eval req_uri=coalesce(uri_path, uri, url)
| eval req_ua=coalesce(http_user_agent, useragent, user_agent)
| where match(req_uri, "(?i)%(25)*77ebui_wsma_https?")
| eval double_encoded=if(match(req_uri, "(?i)%2577ebui_wsma"), "yes", "no")
| eval rootevidence_claimed=if(match(req_ua, "(?i)RootEvidence"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(req_uri) as uris values(req_ua) as user_agents values(dest_port) as dest_ports by src_ip dest double_encoded rootevidence_claimed
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen, "%Y-%m-%dT%H:%M:%SZ")
| eval threat_id="TL-2026-5345", cve="CVE-2023-20198", technique="T1190 T1595.002 T1027 T1059.008 T1082"
| sort - count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL matches regex @"(?i)%(25)*77ebui_wsma_https?"
| extend DoubleEncoded = RequestURL matches regex @"(?i)%2577ebui_wsma", RootEvidenceClaimed = RequestClientApplication has "RootEvidence"
| summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10), UserAgents = make_set(RequestClientApplication, 5) by SourceIP, DestinationIP, DestinationPort, DoubleEncoded, RootEvidenceClaimed
| extend ThreatId = "TL-2026-5345", CVE = "CVE-2023-20198"
| order by Requests desc

Sigma

title: Cisco IOS XE WSMA Endpoint Request With URL-Encoded Path (CVE-2023-20198)
id: 3b8e5a10-6d42-4c7f-9a13-0e5f7c2d8b41
status: experimental
description: Detects web requests to the Cisco IOS XE WSMA endpoint (webui_wsma_http/https) where the leading w is percent-encoded, as seen in November 2026 SANS ISC honeypot data (/%77ebui_wsma_https on port 8000). Likely vulnerability scanning for CVE-2023-20198 that may evade string-matching WAF rules.
references:
  - https://isc.sans.edu/diary/rss/33492
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial-access
  - attack.t1190
  - attack.defense-evasion
  - attack.t1027
  - cve.2023-20198
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - '/%77ebui_wsma_'
      - '/%2577ebui_wsma_'
  condition: selection
falsepositives:
  - Authorized vulnerability or exposure-management scanners testing WAF path normalization
  - Internal penetration tests against Cisco IOS XE devices
level: medium

Known false positives:

• Authorized vulnerability or exposure-management scanners (including genuine RootEvidence scans) probing WSMA paths
• Internal penetration tests or WAF regression tests that deliberately send percent-encoded WSMA paths

Tuning notes: Log the raw request line: many proxies decode %77 before logging, which hides the encoding. Adjust the index and sourcetype to your reverse proxy, WAF or IDS HTTP source. Allowlist verified scanner source IPs, not the RootEvidence User-Agent, which any host can spoof. Alert at higher priority when the source is not a known scanner or the device answers with HTTP 200.

• 🔒 RootEvidence Opt-Out Header Scan and WSMA execCLI 'uname -a' Probe · unlock with TL Creds
• 🔒 Cisco IOS XE Web UI Install Operation Syslog (BadCandy Implant Installation) · unlock with TL Creds
• 🔒 Cisco IOS XE Web UI Login Success from Non-Private Source · unlock with TL Creds
• 🔒 Cisco IOS XE WSMA Double-Encoded Bypass or Direct External WSMA Access (Horizon3 PoC Pattern) · unlock with TL Creds
• 🔒 Cisco IOS XE Privilege-15 Local User Created via Config Log (Generic) · unlock with TL Creds
• 🔒 Traffic to or from Historical CVE-2023-20198 Campaign IPs (Talos Indicators) · unlock with TL Creds
• 🔒 Cisco IOS XE Rogue Local Account Creation with CVE-2023-20198 Campaign Usernames · unlock with TL Creds
• 🔒 BadCandy Implant Check Request to /webui/logoutconfirm.html (CVE-2023-20198 Post-Exploitation) · unlock with TL Creds

Indicators of compromise for RootEvidence Cisco WSMA scanning

As of 2026-11-05, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5345.

Sample indicators (2 of 10)

• IP address: 5.149.249[.]74
• IP address: 154.53.56[.]231

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

How RootEvidence Cisco WSMA scanning works

On 2026-11-05 Johannes Ullrich (SANS ISC) reported POST requests to the Cisco web UI Web Services Management Agent (WSMA) endpoint /%77ebui_wsma_https on port 8000 in SANS ISC honeypot data. The request body is a SOAP envelope that authenticates with a hardcoded credential (the diary cites the default 'admin') and invokes execCLI to run 'uname -a', a read-only reconnaissance command. The diary suspects CVE-2023-20198, and speculates that URL-encoding the letter 'w' in the path is meant to evade 'some stupid WAFs'. The diary says the device family is 'Cisco IOS'; CVE-2023-20198 itself affects Cisco IOS XE with the web UI enabled.

The traffic carries non-standard Opt-Out-Email and Opt-Out-Url headers pointing to rootevidence.com and the User-Agent RootEvidence/1.0. The diary identifies RootEvidence as a vulnerability/exposure management platform that has used these custom headers since December 2025. The source gives no CVSS score, KEV status or post-exploitation activity for this specific traffic, and the CVE attribution is described as suspected. This record is therefore scoped as scanning/probing activity and the severity is set conservatively, while the underlying CVE is rated CVSS 10.0 and is known to be exploited.

Background on the underlying flaw: CVE-2023-20198 is an unauthenticated privilege-escalation flaw in the Cisco IOS XE web UI (CVSS 3.1 10.0, CWE-420 per Cisco) disclosed 2023-10-16 and listed in CISA KEV. In the 2023 campaign, attackers created privilege-15 local accounts (for example cisco_tac_admin, cisco_support, cisco_sys_manager), then chained CVE-2023-20273 (CVSS 7.2) to run commands as root and install the Lua-based BadCandy web-shell implant at /usr/binos/conf/nginx-conf/cisco_service.conf. Horizon3 showed that the bypass reaches the WSMA endpoint in iosd by double URL-encoding the path (/%2577ebui_wsma_HTTP) so that nginx rules blocking direct access to webui_wsma_http/https do not match; the SOAP payload then executes CLI such as 'username baduser privilege 15 secret ...'. Cisco's fix added a Proxy-Uri-Source header check rather than changing path parsing. The 2026 scan differs in that it uses a single-encoded %77 and a harmless 'uname -a' command.

Defenders should treat the RootEvidence headers as self-declared and not as proof of benign intent: any host or user agent can send them. Devices with the web UI exposed should be checked for the 2023 implant and unauthorized local accounts regardless of whether the probe came from a known scanner. Fixed releases include 17.9.4a, 17.6.6a, 17.3.8a and 16.12.10a; the workaround is to disable the HTTP/HTTPS server (no ip http server / no ip http secure-server) or restrict it with ACLs.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059.008 Network Device CLI

Command and Control

T1071.001 Web Protocols

Initial Access

T1078.001 Default Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery

Persistence

T1136.001 Local Account; T1505.003 Web Shell

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for RootEvidence Cisco WSMA scanning

Patches

• Cisco IOS XE fixed releases: 17.9.4a, 17.6.6a, 17.3.8a, 16.12.10a (and later)

Immediate actions

• Disable the web UI on internet-facing devices: no ip http server and no ip http secure-server
• Restrict HTTP/HTTPS management access to trusted networks with ACLs
• Review local accounts for unknown privilege-15 users such as cisco_tac_admin, cisco_support and cisco_sys_manager
• Check logs for %WEBUI-6-INSTALL_OPERATION_INFO with unknown filenames and %SEC_LOGIN-5-WEBLOGIN_SUCCESS from unexpected sources

Workarounds

• Disable the HTTP server feature, or restrict it with ACLs, until patched
• Run the Cisco implant check against exposed devices and inspect for /usr/binos/conf/nginx-conf/cisco_service.conf

Longer-term hardening

• Remove management interfaces from internet exposure per CISA BOD 23-02
• Alert on requests to webui_wsma_http/https paths, including URL-encoded variants, at reverse proxies and IDS
• Treat self-declared scanner identifiers (User-Agent, Opt-Out headers) as unverified and confirm scanner source IPs against vendor-published ranges

Affected and fixed versions

• Cisco — IOS XE Software (web UI enabled)
  Vulnerable versions: 16.1.1 through 17.12.1 with ip http server or ip http secure-server enabled
  Fixed in: 17.9.4a; 17.6.6a; 17.3.8a; 16.12.10a
• Rockwell Automation — Allen-Bradley Stratix 5200/5800
  Vulnerable versions: firmware before 17.12.02
  Fixed in: 17.12.02

Timeline of RootEvidence Cisco WSMA scanning

• 2023-09-18 Cisco Talos observes the first suspicious activity in the later-identified IOS XE web UI exploitation campaign.
• 2023-09-28 Malicious local account creation is detected through a Cisco TAC case.
• 2023-10-16 Cisco publishes its advisory for CVE-2023-20198 (CVSS 10.0) as actively exploited; NVD lists it and CISA adds it to KEV.
• 2023-10-20 Cisco begins releasing fixed software (17.9.4a and others); locked-ioc-10 implant version 2 with Authorization header checks appears from Oct 20.
• 2023-10-30 Horizon3.ai publishes a deep dive and PoC showing the %2577ebui_wsma_HTTP double-encoding bypass to the WSMA SOAP endpoint; exploitation attempts rise sharply around Oct 30-31.
• 2023-11-02 Talos identifies locked-ioc-10 implant version 3, which adds X-Csrf-Token header validation.
• 2025-12-01 locked-ioc-9 begins using Opt-Out-Email and Opt-Out-Url headers on its scanning traffic (per the SANS ISC diary, 'since December 2025'; exact day not stated).
• 2026-11-05 SANS ISC publishes honeypot data showing locked-ioc-5 SOAP probes on port 8000 running 'uname -a' via execCLI with locked-ioc-9/1.0 User-Agent and Opt-Out headers.

Sources cited for RootEvidence Cisco WSMA scanning

• NVD: CVE-2023-20198 NVD (NIST) · Advisory · 2023-10-16
• CISA Known Exploited Vulnerabilities Catalog: CVE-2023-20198 CISA · Government advisory · 2023-10-16
• SANS ISC Diary: Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers (Johannes Ullrich) isc.sans.edu · Research · 2026-11-05
• Cisco Security Advisory: Cisco IOS XE Software Web UI Privilege Escalation Vulnerability Cisco · Vendor report · 2023-10-16
• Cisco Talos: Active exploitation of Cisco IOS XE Software Cisco Talos · Vendor report · 2023-10-16
• Horizon3.ai: Cisco IOS XE CVE-2023-20198 Deep Dive and POC horizon3.ai · Proof of concept · 2023-10-30

More in vulnerability

• OpenSSH on musl libc (Alpine Linux) authentication bypass via overly long password ("*sshole")
• Apache OFBiz Pre-Auth RCE (CVE-2026-68524) and Account Takeover (CVE-2026-109928) Patched in 24.09.08
• ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes Enables Phishing, Malware Delivery, and Silent Data Exfiltration
• Fastjson 1.x Gadget-Free RCE (CVE-2026-16723 / ThreatBook XVE-2026-39684) Under Active Exploitation
• Storm-2603 Fileless ToolShell Breach of On-Prem SharePoint (CVE-2025-53770 / CVE-2025-53771) with Warlock/LockBit Ransomware