Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)

This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.

This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.

POST /%77ebui_wsma_https HTTP/1.1 Host: [redacted]:8000 User-Agent: RootEvidence/1.0 Content-Length: 720 Connection: close Content-Type: text/xml; charset=UTF-8 Opt-Out-Email: re-abuse@rootevidence.com Opt-Out-Url: https://www.rootevidence.com/scanners Accept-Encoding: gzip admin ***** uname -a I highlighted the actual command (uname -a) above.

But also interesting is the use of a "Opt-Out-Email" and "Opt-Out-Url" header. Rootevidence is yet another exposure/vulnerability management Platform.…

Abbreviated excerpt as provided by the publisher; the full article is at the canonical source. Attributed to SANS ISC Diary RSS · Limited verification; verify facts against the linked source. Read the full article on isc.sans.edu.

Source published: 05 Nov 2026, 08:59 PM IST. Source facts take precedence over AI interpretation.