# Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers

> SANS ISC honeypots recorded SOAP POST requests to /%77ebui_wsma_https on port 8000 that run 'uname -a' via execCLI with default credentials, consistent with probing for CVE-2023-20198. The traffic carries Opt-Out-Email and Opt-Out-Url headers and the User-Agent RootEvidence/1.0, which the diary ties to the RootEvidence exposure-management platform, so it is likely scanning rather than post-exploitation.

- **Published:** 2026-11-05T20:49:48Z
- **Last reviewed:** 2026-11-05T20:49:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5345
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5345.png
- **ID:** TL-2026-5345
- **Severity:** MEDIUM (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** RootEvidence
- **Detections:** 9 (1 shown free below) · **IOCs:** 10 (2 shown free below)
- **CVEs:** CVE-2023-20198

## Description

On 2026-11-05 Johannes Ullrich (SANS ISC) reported POST requests to the Cisco web UI Web Services Management Agent (WSMA) endpoint /%77ebui_wsma_https on port 8000 in SANS ISC honeypot data. The request body is a SOAP envelope that authenticates with a hardcoded credential (the diary cites the default 'admin') and invokes execCLI to run 'uname -a', a read-only reconnaissance command. The diary suspects CVE-2023-20198, and speculates that URL-encoding the letter 'w' in the path is meant to evade 'some stupid WAFs'. The diary says the device family is 'Cisco IOS'; CVE-2023-20198 itself affects Cisco IOS XE with the web UI enabled.

The traffic carries non-standard Opt-Out-Email and Opt-Out-Url headers pointing to rootevidence.com and the User-Agent RootEvidence/1.0. The diary identifies RootEvidence as a vulnerability/exposure management platform that has used these custom headers since December 2025. The source gives no CVSS score, KEV status or post-exploitation activity for this specific traffic, and the CVE attribution is described as suspected. This record is therefore scoped as scanning/probing activity and the severity is set conservatively, while the underlying CVE is rated CVSS 10.0 and is known to be exploited.

Background on the underlying flaw: CVE-2023-20198 is an unauthenticated privilege-escalation flaw in the Cisco IOS XE web UI (CVSS 3.1 10.0, CWE-420 per Cisco) disclosed 2023-10-16 and listed in CISA KEV. In the 2023 campaign, attackers created privilege-15 local accounts (for example cisco_tac_admin, cisco_support, cisco_sys_manager), then chained CVE-2023-20273 (CVSS 7.2) to run commands as root and install the Lua-based BadCandy web-shell implant at /usr/binos/conf/nginx-conf/cisco_service.conf. Horizon3 showed that the bypass reaches the WSMA endpoint in iosd by double URL-encoding the path (/%2577ebui_wsma_HTTP) so that nginx rules blocking direct access to webui_wsma_http/https do not match; the SOAP payload then executes CLI such as 'username baduser privilege 15 secret ...'. Cisco's fix added a Proxy-Uri-Source header check rather than changing path parsing. The 2026 scan differs in that it uses a single-encoded %77 and a harmless 'uname -a' command.

Defenders should treat the RootEvidence headers as self-declared and not as proof of benign intent: any host or user agent can send them. Devices with the web UI exposed should be checked for the 2023 implant and unauthorized local accounts regardless of whether the probe came from a known scanner. Fixed releases include 17.9.4a, 17.6.6a, 17.3.8a and 16.12.10a; the workaround is to disable the HTTP/HTTPS server (no ip http server / no ip http secure-server) or restrict it with ACLs.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1059.008 Network Device CLI
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1136.001 Local Account
- T1505.003 Web Shell
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Cisco IOS XE WSMA Endpoint Probe via URL-Encoded Path (CVE-2023-20198 / RootEvidence Scan)** (`TL-2026-5345-SPL-001`)

Detects HTTP requests to the Cisco IOS XE web UI Web Services Management Agent endpoint (webui_wsma_http/https) where the leading 'w' is URL-encoded (/%77ebui_wsma_https), the pattern SANS ISC honeypots recorded on port 8000 in November 2026 running 'uname -a' through execCLI. The encoding is likely meant to slip past string-matching WAF rules in front of CVE-2023-20198 (CVSS 10.0, CISA KEV). The rule also flags whether the request claims the self-declared RootEvidence/1.0 User-Agent, which is spoofable and must not be treated as proof of benign intent.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595.002, T1027, T1059.008, T1082
- **Data sources:** web:access_combined, web:nginx:plus:kv, web:stream:http
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=web (sourcetype=access_combined OR sourcetype=nginx:plus:kv OR sourcetype=stream:http) earliest=-24h
| eval req_uri=coalesce(uri_path, uri, url)
| eval req_ua=coalesce(http_user_agent, useragent, user_agent)
| where match(req_uri, "(?i)%(25)*77ebui_wsma_https?")
| eval double_encoded=if(match(req_uri, "(?i)%2577ebui_wsma"), "yes", "no")
| eval rootevidence_claimed=if(match(req_ua, "(?i)RootEvidence"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(req_uri) as uris values(req_ua) as user_agents values(dest_port) as dest_ports by src_ip dest double_encoded rootevidence_claimed
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen, "%Y-%m-%dT%H:%M:%SZ")
| eval threat_id="TL-2026-5345", cve="CVE-2023-20198", technique="T1190 T1595.002 T1027 T1059.008 T1082"
| sort - count
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL matches regex @"(?i)%(25)*77ebui_wsma_https?"
| extend DoubleEncoded = RequestURL matches regex @"(?i)%2577ebui_wsma", RootEvidenceClaimed = RequestClientApplication has "RootEvidence"
| summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10), UserAgents = make_set(RequestClientApplication, 5) by SourceIP, DestinationIP, DestinationPort, DoubleEncoded, RootEvidenceClaimed
| extend ThreatId = "TL-2026-5345", CVE = "CVE-2023-20198"
| order by Requests desc
```

### Sigma

```yaml
title: Cisco IOS XE WSMA Endpoint Request With URL-Encoded Path (CVE-2023-20198)
id: 3b8e5a10-6d42-4c7f-9a13-0e5f7c2d8b41
status: experimental
description: Detects web requests to the Cisco IOS XE WSMA endpoint (webui_wsma_http/https) where the leading w is percent-encoded, as seen in November 2026 SANS ISC honeypot data (/%77ebui_wsma_https on port 8000). Likely vulnerability scanning for CVE-2023-20198 that may evade string-matching WAF rules.
references:
  - https://isc.sans.edu/diary/rss/33492
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial-access
  - attack.t1190
  - attack.defense-evasion
  - attack.t1027
  - cve.2023-20198
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - '/%77ebui_wsma_'
      - '/%2577ebui_wsma_'
  condition: selection
falsepositives:
  - Authorized vulnerability or exposure-management scanners testing WAF path normalization
  - Internal penetration tests against Cisco IOS XE devices
level: medium
```

**Known false positives:**

- Authorized vulnerability or exposure-management scanners (including genuine RootEvidence scans) probing WSMA paths
- Internal penetration tests or WAF regression tests that deliberately send percent-encoded WSMA paths

**Tuning notes:** Log the raw request line: many proxies decode %77 before logging, which hides the encoding. Adjust the index and sourcetype to your reverse proxy, WAF or IDS HTTP source. Allowlist verified scanner source IPs, not the RootEvidence User-Agent, which any host can spoof. Alert at higher priority when the source is not a known scanner or the device answers with HTTP 200.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RootEvidence Opt-Out Header Scan and WSMA execCLI 'uname -a' Probe (locked: unlock with TL Creds)
- Cisco IOS XE Web UI Install Operation Syslog (BadCandy Implant Installation) (locked: unlock with TL Creds)
- Cisco IOS XE Web UI Login Success from Non-Private Source (locked: unlock with TL Creds)
- Cisco IOS XE WSMA Double-Encoded Bypass or Direct External WSMA Access (Horizon3 PoC Pattern) (locked: unlock with TL Creds)
- Cisco IOS XE Privilege-15 Local User Created via Config Log (Generic) (locked: unlock with TL Creds)
- Traffic to or from Historical CVE-2023-20198 Campaign IPs (Talos Indicators) (locked: unlock with TL Creds)
- Cisco IOS XE Rogue Local Account Creation with CVE-2023-20198 Campaign Usernames (locked: unlock with TL Creds)
- BadCandy Implant Check Request to /webui/logoutconfirm.html (CVE-2023-20198 Post-Exploitation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 10)

Defanged, TLP:CLEAR.

- IP address: `5.149.249[.]74`
- IP address: `154.53.56[.]231`

Full set of 10 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SANS ISC Diary: Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers (Johannes Ullrich)](https://isc.sans.edu/diary/rss/33492)
- [Cisco Security Advisory: Cisco IOS XE Software Web UI Privilege Escalation Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z)
- [NVD: CVE-2023-20198](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-20198)
- [CISA Known Exploited Vulnerabilities Catalog: CVE-2023-20198](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198)
- [Cisco Talos: Active exploitation of Cisco IOS XE Software](https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/)
- [Horizon3.ai: Cisco IOS XE CVE-2023-20198 Deep Dive and POC](https://www.horizon3.ai/attack-research/disclosures/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5345