Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2023-20109

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow…

Description

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability.

Added
10 Oct 2023
Fix due (US federal)
31 Oct 2023
Used by ransomware
Not known

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 10 Oct 2023.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.

Timeline

  1. ID reserved

    By cisco

  2. · 11 months later

    Published

  3. · 13 days later

    Added to CISA KEV

    Known exploited in the wild

  4. · 2 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-20109, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.1Medium6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1Medium6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
2.5% · top 15% of all CVEs (11 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.6.

Affected products

  • Cisco · IOS

    • affected 12.4(24)T
    • affected 12.4(24)T3
    • affected 12.4(22)T1
    • affected 12.4(24)T5
    • affected 12.4(24)T4
    • affected 12.4(22)T
    • affected 12.4(24)T8
    • affected 12.4(24)T2
    • affected 12.4(22)T5
    • affected 12.4(22)T4
    • affected 12.4(24)T1
    • affected 12.4(24)T7
    • affected 12.4(22)T3
    • affected 12.4(24)T6
    • affected 12.4(22)T2
    • affected 12.4(24)T4a
    • affected 12.4(24)T4b
    • affected 12.4(24)T3e
    • affected 12.4(24)T4c
    • affected 12.4(24)T4d
    • affected 12.4(24)T4e
    • affected 12.4(24)T3f
    • affected 12.4(24)T4f
    • affected 12.4(24)T4l
    • affected 12.4(24)MD1
    • affected 12.4(24)MD
    • affected 12.4(24)MD3
    • affected 12.4(24)MD2
    • affected 12.4(22)MD1
    • affected 12.4(22)MD2
    • affected 12.4(24)MD5
    • affected 12.4(22)MD
    • affected 12.4(24)MD4
    • affected 12.4(24)MD6
    • affected 12.4(24)MD7
    • affected 12.4(22)XR5
    • affected 12.4(22)XR4
    • affected 12.4(22)XR7
    • affected 12.4(22)XR2
    • affected 12.4(22)XR6
    • and 634 more

  • Cisco · Cisco IOS XE Software

    • affected 3.7.0S
    • affected 3.7.1S
    • affected 3.7.2S
    • affected 3.7.3S
    • affected 3.7.4S
    • affected 3.7.5S
    • affected 3.7.6S
    • affected 3.7.7S
    • affected 3.7.4aS
    • affected 3.7.2tS
    • affected 3.7.0bS
    • affected 3.7.1aS
    • affected 3.3.0SG
    • affected 3.3.2SG
    • affected 3.3.1SG
    • affected 3.8.0S
    • affected 3.8.1S
    • affected 3.8.2S
    • affected 3.9.1S
    • affected 3.9.0S
    • affected 3.9.2S
    • affected 3.9.1aS
    • affected 3.9.0aS
    • affected 3.4.0SG
    • affected 3.4.2SG
    • affected 3.4.1SG
    • affected 3.4.3SG
    • affected 3.4.4SG
    • affected 3.4.5SG
    • affected 3.4.6SG
    • affected 3.4.7SG
    • affected 3.4.8SG
    • affected 3.5.0E
    • affected 3.5.1E
    • affected 3.5.2E
    • affected 3.5.3E
    • affected 3.10.0S
    • affected 3.10.1S
    • affected 3.10.2S
    • affected 3.10.3S
    • and 324 more

What to do

Exploitation: Cisco discovered attempted exploitation of the GET VPN feature and conducted a technical code review of the feature. This vulnerability was discovered during our internal investigation. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-20109 badge
[![CVE-2023-20109](https://cveledger.app/badge/CVE-2023-20109.svg)](https://cveledger.app/cve/CVE-2023-20109)

Record last updated .