Cisco IOS XE Vulnerability Being Abused in the Wild to Plant BADCANDY

Cybersecurity authorities are raising urgent alarms over a Cisco IOS XE vulnerability being exploited in the wild to plant a non-persistent implant known as BADCANDY across networks worldwide. According to the Australian Signals Directorate, over 150 devices remain compromised in Australia alone as of late October 2025, with remediation efforts following the vulnerability’s weaponisation in October 2023.

The BADCANDY implant, a Lua-based web shell targeting Cisco IOS XE Software with web UI capabilities, enables remote, unauthenticated attackers to create highly privileged accounts and take control of affected devices via CVE-2023-20198.

Since July 2025, ASD assessments indicate that more than 400 Australian devices were potentially compromised, underscoring the campaign’s scale and persistence, while security researchers have documented variations of the implant throughout 2024 and 2025 by multiple threat actor groups, including the SALT TYPHOON threat actor.

Although the implant is non-persistent and does not survive reboots, officials emphasise that rebooting alone is insufficient without applying Cisco’s patch for CVE-2023-20198 and hardening edge devices.