BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government

The Australian Signals Directorate (ASD) warns of ongoing attacks on unpatched Cisco IOS XE devices that abuse CVE-2023-20198 to install a Lua-based webshell named BADCANDY and seize administrative control. According to ASD, the vulnerability allows a remote, unauthenticated attacker to create an account with privilege level 15 on affected systems, with a CVSS score of 10. Variations of the BADCANDY implant have been observed since October 2023, with renewed activity noted throughout 2024 and 2025.

Since July 2025, more than 400 devices in Australia have potentially been compromised, and by late October 2025, over 150 compromised devices were still exposed online. The campaign targets devices with the Web User Interface enabled and HTTP or HTTPS Server features in use, and the webshell is non-persistent after reboot though attackers may retain access via stolen credentials.

ASD urges operators to patch against CVE-2023-20198, remove unauthorized privileged accounts, disable the HTTP server feature, and follow Cisco guidance for IOS XE hardening to prevent re-exploitation.