“Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity.”
CVE-2023-20198 hands an unauthenticated attacker full admin on any IOS XE router or switch with the Web UI exposed. Cisco traced the activity back to September 18 and found it on September 28. The attackers named their accounts “cisco_tac_admin” and “cisco_support”. There is still no patch, so the fix is turning off the web interface Cisco shipped.