On October 16, 2023, Cisco published a vulnerability that affects IOS XE machines running the built-in web server: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

This is tracked as https://nvd.nist.gov/vuln/detail/CVE-2023-20198

By adding a simple Config Check to an existing Cisco IOS ConfigSource, LogicMonitor can help people quickly identify which resources have the web server enabled. Here is an example:

Name: Cisco-CSCwh87343-Check
Check type: "Use Groovy Script"

Groovy script:

/*<br/>The built-in string variable 'config' contains the entire contents of the configuration file. <br/>The following example will trigger an alert when the configuration file contains the string "blue". <br/>if (config.contains("blue")) {<br/>    return 1;<br/>} else {<br/>    return 0;<br/>}<br/>*/<br/><br/>if (config.contains("ip http")) {<br/>    return 1;<br/>} else {<br/>    return 0;<br/>}

Then trigger this type of alert: Warning
Description: "Search for presence of Cisco
CSCwh87343 vulnerability"

Caveats:

-This will apply to all devices where the ConfigSource is used, even though all devices may not be affected by the vulnerability

-This assumes usage of ConfigSources and specifically the Cisco_iOS ConfigSource

Thanks to Todd Ritter for finding this CVE and Creating the ConfigSource