Vulnerability
Exploitation Wave ×2
BadCandy exploitation of Cisco IOS XE routers in Australia
Updated 01.11.2025 15:43
Case score 70
Why this score?
Case score is a discovery signal based on public evidence, not a guaranteed risk rating. Use it to decide what to review first, then verify important details from the linked sources.
- Total
- 70
- Main story score
- 65
- Related evidence lift
- +5 / 20
- Contributing updates
- 2
- Context updates
- 0
Top contributors
- Vulnerability Anchors the case on the Cisco IOS XE web UI flaw and the takeover path used to plant BadCandy. main
- Exploitation Wave Adds the Australia exploitation-wave reporting, compromise counts, and remediation guidance for the same CVE-2023-20198 activity. contributes
- Exploitation Wave Reinforces the same BadCandy reinfection pattern on exposed Cisco IOS XE systems in Australia. contributes
Members 3
First seen 31.10.2025 17:38
Latest activity 01.11.2025 15:43
Overview
Ongoing exploitation of **CVE-2023-20198** on **Cisco IOS XE** routers in Australia is letting operators plant the **BadCandy** webshell on exposed management interfaces. Cisco fixed the flaw in October 2023, but available evidence shows repeated compromise across 2024 and 2025 on systems that stayed reachable and unpatched.
ASD says as many as **400 devices** may have been compromised since July 2025, with **more than 150** still compromised in late October 2025. Operators are being told to patch, harden the web UI, and review privileged accounts and command-accounting logs; rebooting alone does not remove the underlying exposure.
Latest development Open development history ASD warns of ongoing BADCANDY attacks on unpatched Cisco IOS XE devices in Australia The Australian Signals Directorate warned that ongoing cyber attacks in Australia are targeting unpatched Cisco IOS XE devices with BADCANDY, a low-equity Lua-based web shell tied to exploitation of CVE-2023-20198. ASD said the vulnerability has been actively exploited since late 2023, variations of BADCANDY have been detected since October 2023, and as many as 400 devices in Australia may have been compromised since July 2025, including 150 in October. The agency urged operators to apply patches, limit public exposure of the web user interface, and review privileged accounts, unknown tunnel interfaces, and TACACS+ AAA command accounting logs.
-
Australian government warns of ongoing BadCandy infections on unpatched Cisco IOS XE routers
The Australian Signals Directorate is notifying victims after detecting ongoing exploitation of CVE-2023-20198 against unpatched Cisco IOS XE devices in Australia, where the Lua-based BadCandy webshell can let remote unauthenticated attackers create a local admin user through the web interface, gain root command execution, and re-introduce the implant after reboot if the web interface remains exposed. The agency says over 400 devices were potentially compromised since July 2025 and more than 150 were still compromised as at late October 2025, with internet service providers asked to contact victims whose owners cannot be identified and administrators directed to patch and harden affected devices.
Attackers are exploiting **CVE-2023-20198** on **Cisco IOS XE** devices in Australia to plant the **BadCandy** Lua webshell on exposed routers. The flaw lets a remote unauthenticated attacker create a local admin account through the web interface and take control of the device. Cisco fixed the vulnerability in October 2023, but public exploit availability and exposed management interfaces kept the attack path open through 2024 and 2025.
ASD assessed that as many as **400 devices** in Australia were potentially compromised since July 2025, and more than **150 devices** were still compromised in late October 2025. The webshell is removed on reboot, but attackers can reintroduce it whenever the web interface remains reachable, so rebooting alone does not close the exposure. ASD and Cisco are telling operators to patch, harden access to the web user interface, review privileged accounts and TACACS+ command accounting logs, and contact affected owners through ISPs where needed. Available evidence does not establish the full global reach or firm attribution for the activity, so the broader scope remains unquantified.
Signals
Impact signals
Exploitation
CVEs/products
Geographic context
Remediation
Threat context
Threat actor context
1 listedMalware context
1 familiesTechnical intelligence
Existing Case dataMember happenings
Vulnerability
Cisco IOS XE remote admin flaw (CVE-2023-20198)
Exploitation
Active Exploitation
Exploit
Public Exploit
CVSS
10.0 Critical
Patch
Patch Available
Vulnerability
Cisco IOS XE remote admin flaw (CVE-2023-20198)
Exploitation
Active Exploitation
Exploit
Public Exploit
CVSS
10.0 Critical
Patch
Patch Available
Exploitation Wave
Cisco IOS XE BADCANDY exploitation wave (CVE-2023-20198)
Exploitation
Active Exploitation
CVSS
10.0 Critical
Patch
Patch Available
Exploitation Wave
Cisco IOS XE BADCANDY exploitation wave (CVE-2023-20198)
Exploitation
Active Exploitation
CVSS
10.0 Critical
Patch
Patch Available
Exploitation Wave
Cisco IOS XE BadCandy exploitation wave
Exploitation
Active Exploitation
Patch
Patch Available
Exploitation Wave
Cisco IOS XE BadCandy exploitation wave
Exploitation
Active Exploitation
Patch
Patch Available