Cisco discloses new IOS XE zero-day exploited to deploy malware implant

Cisco highlighted a serious zero-day (CVE-2023-20273) exploited by attackers to infiltrate IOS XE devices, exacerbating a previous zero-day vulnerability (CVE-2023-20198). With over 40,000 devices already compromised, Cisco anticipates fixes for both vulnerabilities to be available on October 22. In the meantime, it has advised administrators to disable the HTTP server feature on all internet-facing systems and look for suspicious user activity.