Vulnerability record · CVE-2023-20109 · published 27 September 2023
CVE-2023-20109: Cisco IOS/IOS XE GET VPN out-of-bounds write allows code execution
Cisco · Ios
Cisco IOS and IOS XE GET VPN fails to properly validate attributes in the GDOI and G-IKEv2 protocols, leading to an out-of-bounds write (CWE-787). An attacker with administrative control of a group member or key server can trigger it, and a successful exploit can execute arbitrary code or crash the device.
Description
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with a past remediation deadline and enables full device compromise, though exploitation requires prior administrative access.
What it is
Cisco IOS and IOS XE GET VPN fails to properly validate attributes in the GDOI and G-IKEv2 protocols, leading to an out-of-bounds write (CWE-787). An attacker with administrative control of a group member or key server can trigger it, and a successful exploit can execute arbitrary code or crash the device.
Impact
An attacker gains full control of the affected device through arbitrary code execution, or causes a reload resulting in denial of service.
Attack surface
Reachable remotely over the network via the GET VPN GDOI/G-IKEv2 protocols, but requires high privileges: the attacker must already have administrative control of a group member or key server, or compromise a key server and point a group member at it. No user interaction is needed.
Exploitation
Listed in CISA KEV with a 2023-10-31 remediation due date, indicating known exploitation; EPSS 30-day probability is 0.02344 (82.8th percentile). No ransomware campaign use is documented.
What to do
- Apply the Cisco vendor advisory fixes for IOS and IOS XE GET VPN as the first action.
- If patching is not possible, follow Cisco's mitigations or discontinue use of the affected GET VPN feature per CISA guidance.
- Restrict administrative access to group members and key servers to trusted personnel and networks.
- Monitor and control which key servers group members are configured to use to prevent redirection to attacker-controlled servers.
Detection
- Alert on unexpected device reloads or crashes on IOS/IOS XE devices running GET VPN.
- Monitor GET VPN GDOI/G-IKEv2 key server configuration changes on group members.
- Review logs for anomalous key server registrations or attribute exchanges involving untrusted key servers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2023-20109 to the Known Exploited Vulnerabilities catalog on 10 October 2023 as "Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 31 October 2023.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-20109 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-20109), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.
