Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
The Cisco vulnerabilities CVE-2023-10198 and CVE-2023-20273 are well known and have been exploited by attackers to install the BadCandy web shell. An attacker then can run arbitrary commands and launch attacks on additional internal networks from the web shell.
Kill Chain
Risk Score
87
An attacker can install the BadCandy web shell implant by exploiting two well-known vulnerabilities (CVE-2023-20198 and CVE-2023-20273) in the web UI of Cisco IOS XE. After installing the BadCandy implant, an attacker can communicate with the implant by sending an HTTP request that has both a specific path and a query. The query can consist of different commands, depending on the objective of the attacker.
Install relevant patches to affected Cisco IOS XE versions
