Skip to content

Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability - 20231011004

Overview

The WA SOC has observed a vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software, which could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.

What is the vulnerability?

CVE-2023-20109 - CVSS v3 Base Score: 6.6

What is vulnerable?

The vulnerability affects the following Cisco products running a vulnerable release versions;

  • Cisco IOS Software or Cisco IOS XE Software
  • GDOI or G-IKEv2 protocol enabled

What has been observed?

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.

Recommendation

The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of one month (refer Patch Management):