CVE-2023-20109mediumunder attackCWE-787

CVE-2023-20109: medium-severity vulnerability in Cisco IOS

Published · Updated

Follow this CVE+ Monitor Cisco IOS XE+ Monitor IOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.6epss 2.5%
from disclosure to weapon
Published on NVDSep 27
CISA KEV+13d
Action required by CISAfederal deadline: 2023-10-31

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Cisco's GET VPN feature allows an authenticated attacker who controls a VPN key server or group member to run malicious code or crash the device. The vulnerability exists because the system doesn't properly validate certain protocol messages, making it dangerous if someone with admin access turns malicious.

Technical detail

CWE-787 (out-of-bounds write) in GDOI and G-IKEv2 protocol handling within Cisco GET VPN allows authenticated remote attackers with administrative privileges on key servers or group members to inject malformed attributes that bypass validation, enabling arbitrary code execution or device denial of service. Pre-condition: attacker must compromise or control a key server, or reconfigure a group member to point to attacker-controlled infrastructure.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco IOS XE SoftwareCisco · IOS
Related CVEs — Cisco IOS

In the same product, most dangerous first.

CVE-2023-20198CRITICALCVE-2023-20198EPSS 99.6%KEVCVE-2023-20273HIGHCVE-2023-20273EPSS 92.9%KEVCVE-2017-6736HIGHCVE-2017-6736EPSS 70.4%KEVCVE-2017-6737HIGHCVE-2017-6737EPSS 45.0%KEVCVE-2025-20352HIGHCVE-2025-20352EPSS 40.6%KEVCVE-2017-6742HIGHCVE-2017-6742EPSS 21.4%KEV