Cisco, the IT services and product solutions manufacturer, has disclosed the chaining-together of two (2) critical zero-day vulnerabilities that have been actively exploited by unknown threat actors to deliver the malicious Lua backdoor to thousands of enterprise network devices. The flaws affect the web UI feature of Cisco’s Internetworking Operating System (IOS). The first vulnerability in the attack-chain, tracked as CVE-2023-20198 (with a CVSS score of 10/10), allows remote unauthenticated attackers to create accounts with privilege level 15 access, allowing them to create local user and password combinations and facilitating the complete takeover of vulnerable systems. The second flaw, tracked as CVE-2023-20273 (with a CVSS score of 7.2/10) is a privilege escalation vulnerability used alongside the first bug, allowing the threat actor to escalate the permissions of the newly created user to root. Although this attack-chain could be devastating if exploited, it only impacts enterprise networking devices with the web UI feature enabled and exposed to the public internet or to untrusted networks. Administrators were urged to completely disable the HTTP server feature before the vulnerabilities were patched on October 22, 2023. CTIX analysts recommend that all administrators responsible for the affected devices ensure that they are running the most up-to-date firmware to prevent a network compromise.