ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability

According to The Australian Signals Directorate, the ASD has issued a bulletin about ongoing BADCANDY attacks targeting unpatched Cisco IOS XE devices in Australia, exploiting CVE-2023-20198 (CVSS 10.0). Variations of BADCANDY have been detected since October 2023, with a fresh wave of attacks continuing through 2024 and 2025. The agency estimates that as many as 400 devices in Australia have been compromised since July 2025, including 150 infections in October alone.

BADCANDY is described as a low equity Lua-based web shell that attackers commonly apply a non-persistent patch post-compromise to mask the device’s vulnerability status in relation to CVE-2023-20198, and re-exploitation has occurred on previously notified devices. The ASD advises patching, limiting public exposure of the web UI, and following Cisco hardening guidelines to prevent future exploitation, noting that a reboot does not undo other attacker actions. It also notes that China-linked Salt Typhoon has used the vulnerability in recent months to breach telecommunications providers.