CVE Watch—

CVE-2023-20109

Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

CVSS

—

Sem CVSS

EPSS

2.5%

p85

KEV

SIM

10 de out. de 2023

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

2.5%EPSS · 30 dias2.5%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Cisco / IOS and IOS XE

Vulnerabilidade

Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

Adicionado ao KEV

10 de out. de 2023

Corrigir até

31 de out. de 2023

Uso conhecido em ransomware

Não

Descrição resumida

Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx; https://nvd.nist.gov/vuln/detail/CVE-2023-20109

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2025-203527.7 ALT

98.7%

KEV—80Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability41d CVE-2017-3881—

99.9%

KEV—80Cisco IOS and IOS XE Remote Code Execution Vulnerability—CVE-2018-0171—

99.9%

KEV—80Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability—