Ongoing Exploitation of Cisco IOS XE Vulnerability with BadCandy Implant

Cyberattacks exploiting a critical vulnerability in Cisco IOS XE (CVE-2023-20198) continue, with over 150 devices in Australia still infected with the BadCandy webshell as of late October 2025. Despite patches being available for over two years, many devices remain unpatched and vulnerable to re-infection. The Australian Signals Directorate warns that attackers can detect and reinstall the BadCandy implant if removed.