Johannes Ullrich reported a Cisco IOS exploit attempt that appears to target CVE-2023-20198. The request was a POST to /%77ebui_wsma_https on port 8000, using a SOAP envelope that runs the command "uname -a" via the execCLI element. Notably, the traffic included custom "Opt-Out-Email" and "Opt-Out-Url" headers, which Ullrich says are used by the Rootevidence vulnerability management platform and have not been documented in any standard. Rootevidence has employed these headers since December of the previous year, and the URL shows a URL-encoded "w" character, which could trick some web application firewalls. Ullrich observed the activity while reviewing honeypot data and noted it as the first instance of these headers he has seen. 1