A New Vulnerability Scan Tactic Emerges, Targeting Older Cisco IOS Systems
Cybersecurity researchers have recently spotted a novel tactic used by vulnerability scanners to probe for weaknesses in older versions of Cisco’s Internetwork Operating System (IOS). The scans, attributed to Rootevidence, a platform that offers exposure and vulnerability management tools, are targeting systems vulnerable to the CVE-2023-20198 exploit.
The scans involve sending HTTP requests with unusual header fields, including “Opt-Out-Email” and “Opt-Out-Url”. These headers, which appear to be proprietary to Rootevidence, are used to bypass traditional security measures. Specifically, they are designed to identify users who may be scanning their own systems and exempt them from further probing. However, this tactic has raised eyebrows among researchers, as it blurs the line between legitimate vulnerability assessment and potentially malicious activity.
The scans themselves are straightforward, using a SOAP (Simple Object Access Protocol) request to authenticate with the system using a username of “admin” and an encoded password. The request then attempts to execute a command on the vulnerable system, in this case, retrieving information about the system’s architecture via the “uname -a” command.
The use of these tactics by Rootevidence has sparked debate within the cybersecurity community. While the company claims that their platform is designed to help organizations identify and remediate vulnerabilities, some experts argue that their methods could be misused by malicious actors. As the landscape of vulnerability scanning continues to evolve, it’s essential for users to remain vigilant and scrutinize any requests made to their systems.
The emergence of this tactic serves as a reminder that cybersecurity threats are constantly adapting and evolving. Users should exercise caution when engaging with platforms like Rootevidence, ensuring they understand the terms and conditions of their services, including any potential risks associated with using them. To avoid falling prey to such tactics, it’s crucial for organizations to maintain robust security measures, including regular updates and thorough network monitoring.
Ultimately, this development highlights the importance of ongoing cybersecurity education and awareness. By staying informed about emerging threats and best practices, users can better protect themselves against potential vulnerabilities and maintain a secure online presence.
Source: SANS ISC — 2026-11-05