All vulnerabilities
CVE-2023-20109

Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

Cisco IOS and IOS XEOperating systems
Open in ThreatlineRecord JSON
CVSS
6.6Medium
ExploitationExploited in the wildAdded to KEV 10 Oct 2023CISA KEV
Exploit odds (EPSS)2.48%Chance of exploitation activity in the next 30 days, higher than 84% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline31 Oct 2023Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 27 Sep 2023, 17:23 UTCPublishedCVE List
  2. 10 Oct 2023Added to CISA KEVCISA KEV

Description

Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.

Text from CVE List

Affected versions 60

  • IOSaffected: 12.4(24)TCVE List
  • IOSaffected: 12.4(24)T3CVE List
  • IOSaffected: 12.4(22)T1CVE List
  • IOSaffected: 12.4(24)T5CVE List
  • IOSaffected: 12.4(24)T4CVE List
  • IOSaffected: 12.4(22)TCVE List
  • IOSaffected: 12.4(24)T8CVE List
  • IOSaffected: 12.4(24)T2CVE List
  • IOSaffected: 12.4(22)T5CVE List
  • IOSaffected: 12.4(22)T4CVE List
  • IOSaffected: 12.4(24)T1CVE List
  • IOSaffected: 12.4(24)T7CVE List
  • IOSaffected: 12.4(22)T3CVE List
  • IOSaffected: 12.4(24)T6CVE List
  • IOSaffected: 12.4(22)T2CVE List
  • IOSaffected: 12.4(24)T4aCVE List
  • IOSaffected: 12.4(24)T4bCVE List
  • IOSaffected: 12.4(24)T3eCVE List
  • IOSaffected: 12.4(24)T4cCVE List
  • IOSaffected: 12.4(24)T4dCVE List
  • IOSaffected: 12.4(24)T4eCVE List
  • IOSaffected: 12.4(24)T3fCVE List
  • IOSaffected: 12.4(24)T4fCVE List
  • IOSaffected: 12.4(24)T4lCVE List
  • IOSaffected: 12.4(24)MD1CVE List
  • IOSaffected: 12.4(24)MDCVE List
  • IOSaffected: 12.4(24)MD3CVE List
  • IOSaffected: 12.4(24)MD2CVE List
  • IOSaffected: 12.4(22)MD1CVE List
  • IOSaffected: 12.4(22)MD2CVE List
  • Cisco IOS XE Softwareaffected: 3.7.0SCVE List
  • Cisco IOS XE Softwareaffected: 3.7.1SCVE List
  • Cisco IOS XE Softwareaffected: 3.7.2SCVE List
  • Cisco IOS XE Softwareaffected: 3.7.3SCVE List
  • Cisco IOS XE Softwareaffected: 3.7.4SCVE List
  • Cisco IOS XE Softwareaffected: 3.7.5SCVE List
  • Cisco IOS XE Softwareaffected: 3.7.6SCVE List
  • Cisco IOS XE Softwareaffected: 3.7.7SCVE List
  • Cisco IOS XE Softwareaffected: 3.7.4aSCVE List
  • Cisco IOS XE Softwareaffected: 3.7.2tSCVE List
  • Cisco IOS XE Softwareaffected: 3.7.0bSCVE List
  • Cisco IOS XE Softwareaffected: 3.7.1aSCVE List
  • Cisco IOS XE Softwareaffected: 3.3.0SGCVE List
  • Cisco IOS XE Softwareaffected: 3.3.2SGCVE List
  • Cisco IOS XE Softwareaffected: 3.3.1SGCVE List
  • Cisco IOS XE Softwareaffected: 3.8.0SCVE List
  • Cisco IOS XE Softwareaffected: 3.8.1SCVE List
  • Cisco IOS XE Softwareaffected: 3.8.2SCVE List
  • Cisco IOS XE Softwareaffected: 3.9.1SCVE List
  • Cisco IOS XE Softwareaffected: 3.9.0SCVE List
  • Cisco IOS XE Softwareaffected: 3.9.2SCVE List
  • Cisco IOS XE Softwareaffected: 3.9.1aSCVE List
  • Cisco IOS XE Softwareaffected: 3.9.0aSCVE List
  • Cisco IOS XE Softwareaffected: 3.4.0SGCVE List
  • Cisco IOS XE Softwareaffected: 3.4.2SGCVE List
  • Cisco IOS XE Softwareaffected: 3.4.1SGCVE List
  • Cisco IOS XE Softwareaffected: 3.4.3SGCVE List
  • Cisco IOS XE Softwareaffected: 3.4.4SGCVE List
  • Cisco IOS XE Softwareaffected: 3.4.5SGCVE List
  • Cisco IOS XE Softwareaffected: 3.4.6SGCVE List

References 3