SANS ISC sees Cisco IOS XE scans that carry Opt-Out-Email and Opt-Out-Url headers
Victoria Shinder1 min readJohannes Ullrich of the SANS Internet Storm Center wrote on 5 November about a Cisco IOS exploit attempt found in the ISC honeypot data. He says the attempt itself is nothing new and suspects it targets CVE-2023-20198, the IOS XE web UI flaw.
The request is a POST to the web services management agent path, with the w of webui URL-encoded as %77, and carries a SOAP envelope with an admin user name and a masked password. The command inside the execCLI element is uname -a. Ullrich notes that the encoded letter could be meant to slip past web application firewalls that match the plain path.
What caught his attention were two headers: Opt-Out-Email and Opt-Out-Url, pointing to the vendor RootEvidence, which describes itself as an exposure and vulnerability management platform, together with the user agent RootEvidence/1.0. He writes that he could not find a standard that proposes such headers and that this is the first time he has noticed them, although the vendor has used them since December last year.
What it means
A scanner that names itself and offers an opt-out is easier to filter than one that hides, but the request is still an exploit attempt against an admin interface. The practical advice is unchanged since 2023: the IOS XE web UI should not be reachable from the internet.