Technotes: Troubleshooting Tips

The following information provides assistance when working with the IoT OD Application Manager.

Troubleshooting of Externally Managed Devices

After following the IoT OD Service activation on an externally-managed IE3x00 device steps to onboard a device in IoT OD, the following INFO lines should appear in the Event Log tab of the device and its status should now appear as UP.

The following information provides assistance when working with device onboarding issues (indicated in Event Logs).

Cisco IOS XE Software Web UI Privilege Escalation Vulnerability [CVE-2023-20198]

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. IOS-XE routers and switches that are directly exposed to the internet, or an untrusted network such as a public access network, and have their HTTP or HTTPS server access enabled may be exposed to Cisco IOS XE Software Web UI Privilege Escalation Vulnerability.

Am I vulnerable?

The "ip http server" and "ip http secure-server" configuration lines that enable a web server on the device can be accessed externally using ports TCP 80 and TCP 443, which maybe be vulnerable to an attack. If the device is exposed to the internet or an untrusted network, and without enterprise firewall protection, it is important to control access to this web service and prevent potential security risks. See (https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/). One way to check is to try and access ports 80 and 443 on your device. For example, you can use "telnet 80" and "telnet 443" and check if the port is open.

For a wider and more automated verification, tools such as nmap can be used to scan a complete network. For example:

nmap -sT --open -p 80,443 192.168.2.0/24

Irrespective of any security vulnerability, the recommendation is to never leave unnecessary ports open and in particular on an untrusted network, and to always place devices behind an enterprise-grade firewall and be able to perform stateful traffic inspection.

If adding an enterprise firewall is not possible, exposed ports can be eliminated with access control lists (ACLs) configured and applied on either the Web server directly (see option 1 below), or the interface(s) pointing to the untrusted network (see option 2 below).

Modify the lists to accommodate different access modes that are required. For example, if you need access to the device's local web server or if DNAC requires access, you can include the IPs or subnet used for access in the allowed list, and deny access to all others.

Two ways of protection

Option 1: Filter Cisco IOS XE WebUI Using an Access List

Refer to the Cisco article that explains how to filter traffic going to the embedded HTTP and HTTPS server on the IOS-XE device: https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-17/221107-filter-traffic-destined-to-cisco-ios-xe.html

Option 2. Filter all traffic to Cisco IOS XE WebUI from untrusted network interfaces

In the following example for ACL creation, line 10 and other subsequent permit statements are used to allow access to port 443 from local enterprise IP/subnets. For example, the client from IP address 10.10.10.10 will be allowed HTTPS access to the device webserver. Lines 15 and 16 deny such access to ports 443 and port 80 to anyone else. Line 20 permits all other IP access for normal operation.

ip access-list extended NO-HTTP-S
  10 permit tcp 10.10.10.10 0.0.0.0 any eq 443
  15 deny tcp any any eq 443
  16 deny tcp any any eq 80
  20 permit ip any any 
  

Apply the above access list on the interface that is used to access internet (in the below example, it is assumed that GigabitEthernet1/1 is used for internet access).

interface GigabitEthernet1/3
 ip access-group NO-HTTP-S in