How does Holm Security support detection for Cisco's IOS XE software Privilege Escalation Vulnerability (CVE-2023-20198)?

Cyber security experts have issued a warning about a critical zero-day vulnerability in Cisco's IOS XE software. This flaw, known as CVE-2023-20198, poses a significant threat to enterprise networking gear, allowing remote attackers to gain full control over affected systems. Recent reports indicate that this vulnerability has been actively exploited in the wild, impacting thousands of Cisco devices globally.

Update 2023-10-23: New test added

HID-2-1-5344961:

• Local detection (Authentication required)
• The test will verify if the vulnerable Cisco version is present. Authentication is required to fetch information about the installed Cisco version.

Update 2023-10-18: two tests added

The security research and development team has released two HIDs that will cover the detection of this vulnerability.

• Remote detection (no authentication required)
• This test will be run automatically in all scan profiles utilizing full vulnerability coverage.

• Local detection (authentication required)
• To utilize this test, it is necessary to configure your network scan profile and enable authenticated scanning on your network assets.