Cisco IOS XE Exploit - CVE-2023-20198

The web interface of Cisco Internetworking Operating System (IOS) XE has a privilege escalation vulnerability that allows attackers to create an account with administrator (level 15) privileges. To exploit this vulnerability, the attacker sends a malicious HTTP request with a SOAP payload and a double URL-encoded URI that specifies the /webui_wsma_http or /webui_wsma_https endpoints. These endpoints are normally restricted, but the vulnerability enables the restriction to be bypassed (1). The victim processes the payload and sends an HTTP response with a SOAP payload that contains the account information and a 200 status code to the attacker (2). After the account is created, the attacker can chain this exploit with an exploit of CVE-2023-20273 to install malware on the device.