Actively exploited in the wild
Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability
Cisco - IOS and IOS XE · Listed in the CISA KEV since 2023-10-10. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-20109
MediumCVSS 6.6KEVSummary
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS and IOS XE Software could allow an authenticated, remote attacker with administrative control of a group member or key server to execute arbitrary code or cause a device crash. It is due to insufficient validation of attributes in GDOI and G-IKEv2 protocols.
Risk Assessment
Risk of full device compromise or denial of service in networks using GET VPN.
Recommendation
Apply Cisco IOS/IOS XE updates and secure the GET VPN infrastructure against unauthorized administrative access.
Other vulnerabilities in Cisco IOS and IOS XE
See all- CVE-2016-6384High
Cisco IOS versions 12.2 through 12.4 and 15.0 through 15.6, as well as IOS XE versions 3.1 through 3.17 and 16.2, are vulnerable to an attack that can lead to denial of service via crafted fields in an H.323 message.
- CVE-2016-6382High
Cisco IOS versions 15.2 through 15.6 and IOS XE versions 3.6 through 3.17 and 16.1 are vulnerable to an attack that can cause a remote denial of service by a malformed IPv6 PIM register packet.
- CVE-2016-6381High
A vulnerability in Cisco IOS 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.18 and 16.1 allows remote attackers to cause a denial of service via fragmented IKEv1 packets, leading to memory consumption or device reload.
- CVE-2015-0643High
Cisco IOS versions 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4, as well as IOS XE versions 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S are vulnerable to denial of service attacks by sending malformed IKEv2 packets. Attackers can exploit this vulnerability to cause memory consumption and device reload.
- CVE-2015-0642High
Cisco IOS versions 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4, as well as IOS XE versions 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S are vulnerable to an attack that can cause a device reload by sending malformed IKEv2 packets. This vulnerability can be exploited over both IPv4 and IPv6 networks.
- CVE-2015-0637High
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS versions 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) via spoofed AN messages.
Original NVD description (English source)
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.