Cisco IOS XE: the vulnerabilities attackers are using, and five things to check on your switches

Search for the CVE list for Cisco IOS XE and you get hundreds of entries, most of them a reload under unusual conditions. A team with one network engineer cannot read them all, and does not need to. The list that matters is shorter: the flaws attackers have actually used.

That list exists. The US agency CISA keeps a catalogue of Known Exploited Vulnerabilities, added to only when there is evidence of use in real attacks. In its edition of 20 October 2026, 28 entries cover IOS XE, alone or together with classic IOS. Most date from 2017 and 2018. Four are from the last three years, and two of those are the reason this page exists.

1 · The four recent ones

CVE-2023-20198 and CVE-2023-20273, the web interface. In October 2023 attackers used the first to create an administrator account on switches and routers whose web interface could be reached, with no password needed, and the second to write an implant to the device as root. Within days, scans by Censys counted about 42,000 devices showing the implant. Both are fixed in current releases, and neither can be used if the web interface is off.

CVE-2025-20352, SNMP. A stack overflow in the SNMP service of both IOS and IOS XE, added to the catalogue on 29 September 2025. With SNMP credentials, an attacker can reload the device; with administrator credentials as well, they can run code as root. Cisco said it found the flaw used in attacks after local administrator credentials had been stolen. Default or guessable community strings are what make it reachable.

CVE-2023-20109, Group Encrypted Transport VPN. Needs an attacker who already controls a key server or group member. If you do not run GET VPN, it does not apply.

2 · The old ones still in use

An old CVE is not a retired one. In August 2025 the FBI warned that state-backed actors were exploiting CVE-2018-0171, in Cisco Smart Install, to copy the configuration of thousands of network devices and change some of them. The flaw was fixed in 2018. Smart Install listens on TCP port 4786 and accepts commands without a password, which is why a seven-year-old bug is still worth an attacker’s time.

The rest of the catalogue’s IOS XE entries fall into a few families:

• SNMP (CVE-2017-6736 to 6743): remote code execution for anyone holding the community string.
• Cluster Management Protocol (CVE-2017-3881): code execution over Telnet, with no login.
• DHCP relay, QoS and IKE (CVE-2017-12240, CVE-2018-0151, CVE-2018-0158/0159 and others): crashes or code execution from crafted packets.
• LLDP (CVE-2018-0167, CVE-2018-0175): from a device on the same network segment.

Read across them and a pattern shows: almost every one needs a service that a typical office switch does not have to run, or a password that should never have been the default.

3 · Five things to check today

Each is one command on the switch, and each closes a family above.

• The web interface. show running-config | include ip http. Unless you manage the switch through it, set no ip http server and no ip http secure-server. While there, look at show running-config | include username for accounts nobody remembers creating.
• Smart Install. show vstack config. Unless this switch is the Smart Install director, run no vstack.
• SNMP. show running-config | include snmp-server community. Remove public, private and anything with RW; limit what remains to your monitoring server with an access list; move to SNMPv3 where the monitoring tool supports it.
• Telnet. Under line vty 0 15, set transport input ssh. That alone removes the Cluster Management Protocol route.
• The version. show version, then put the release into Cisco’s Software Checker, which lists every advisory that affects it and the first fixed release in your train.

Our free switch config check does the first four for you, and twenty-odd other checks besides: paste the output of show running-config and it removes every password, key and community string before it reads anything. The file never leaves your browser.

4 · Reading your version against the fix

The Software Checker gives a first fixed release per train, for example a 17.9 or 17.12 release. If you are on that train at or above it, that advisory is closed. If you are on an older train that has no fixed release, the answer is an upgrade to a supported train, and that is also the moment to check whether the hardware itself is past its end of support, because a switch Cisco no longer patches cannot be fixed by configuration alone.

If a vulnerability scanner has already given you a list of Cisco findings, our scan prioritiser marks the ones on CISA’s catalogue, so the twenty that matter come out of the two thousand that do not.

Questions people ask