Itnews.Au

Ongoing Exploitation of Cisco IOS XE Vulnerability with BADCANDY Webshell

First seen 23 Nov 2025, 03:35 UTC • Theregister

•100% similarity •21.5

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Cyberattacks exploiting the critical Cisco IOS XE vulnerability (CVE-2023-20198) continue to affect Australian devices, with over 150 routers and switches still infected with the BADCANDY webshell as of late October 2025. Despite patches being available for over two years, threat actors are actively targeting unpatched devices, demonstrating the persistent risk posed by known vulnerabilities.

ThreatCluster AI

Attack Flow

8 entities, 8 inferred relationships (STIX 2.1).

Threat Actor (1)

Salt Typhoon

Technique (3)

Malware
Zero-day Exploit
Web Shell

Vulnerability (1)

CVE-2023-20198

Malware (1)

Badcandy

Affected Platform (1)

Cisco IOS XE

Tool (1)

Lua-based web shell

Relationships

Salt Typhoon uses Badcandy
Salt Typhoon uses Lua-based web shell
Salt Typhoon uses Malware
Salt Typhoon uses Zero-day Exploit
Salt Typhoon uses Web Shell
Badcandy exploits CVE-2023-20198
Lua-based web shell exploits CVE-2023-20198
CVE-2023-20198 targets Cisco IOS XE

Community

Browse all →

Ongoing Exploitation of Cisco IOS XE Vulnerability with BADCANDY Webshell

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading