SANS researcher spots Cisco IOS exploit attempt in honeypot traffic

Johannes Ullrich of the SANS Internet Storm Center reports a Cisco IOS exploitation attempt observed in honeypot traffic, with the activity suspected to target CVE-2023-20198. The incident was uncovered while reviewing attempts to exploit vulnerabilities in older Cisco IOS devices, rather than findings from new Cisco advisories. The evidence described centres on a POST request to /%77ebui_wsma_https over port 8000, bearing a SOAP/XML payload.

The request includes a SOAP body that executes a command (uname -a) via a remote CLI channel, within a SOAP envelope that also contains WS-Security headers with a username token (admin) and a Password placeholder. The request also carries unusual headers labelled Opt-Out-Email and Opt-Out-Url.

The researcher notes an additional curiosity in the headers: Opt-Out-Email and Opt-Out-Url appear to be part of a vulnerability management platform’s data or reporting workflow from Rootevidence, which Ullrich says has used such headers since December of the previous year. He observes that Rootevidence appears to be supplying or exposing exploit-related data, and he highlights the use of URL-encoded characters (notably the “w” in the URL) as a potential angle for evading some Web Application Firewalls.

The article frames these observations as specific, traceable indicators from honeypot data rather than general advisories, and attributes the discovery and interpretation to Ullrich and the SANS ISC, with no broader claims about current widespread exploitation.