---
id: "CVE-2023-20109"
kind: "vulnerability"
aliases: ["CVE-2023-20109"]
title: "A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE\u2026"
severity: "high"
cvss: 6.6
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco IOS and IOS XE", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)md", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)md1", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)md2", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)mda", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)mda1", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)mda2", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)mda3", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)mda4", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)mda5", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)mda6", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)t", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)t1", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)t2", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)t3", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)t4", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)t5", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr1", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr2", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr3", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr4", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr5", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr6", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr7", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr8", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr9", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr10", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr11", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(22\\)xr12", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)md", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)md1", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)md2", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)md3", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)md4", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)md5", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)md6", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)md7", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)mda1", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)mda2", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)mda3", "ecosystem": "vendor"}, {"name": "cisco ios", "fixed": [], "affected": "= 12.4\\(24\\)mda4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "exploited", "get-vpn", "infrastructure", "ios", "ios-xe", "network-appliance"]
not_affected_if: ["default-config", "no-get-vpn"]
published_at: "2023-09-27T18:15:10+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20109", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE…

Cisco IOS and IOS XE have an out-of-bounds write in the Group Encrypted Transport VPN (GET VPN) feature. An attacker with administrative control of a GET VPN group member or key server can run malicious code on the device or crash it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco IOS and IOS XE affected ? fixed ?
- vendor:cisco ios affected = 12.4\(22\)md fixed ?
- vendor:cisco ios affected = 12.4\(22\)md1 fixed ?
- vendor:cisco ios affected = 12.4\(22\)md2 fixed ?
- vendor:cisco ios affected = 12.4\(22\)mda fixed ?
- vendor:cisco ios affected = 12.4\(22\)mda1 fixed ?
- vendor:cisco ios affected = 12.4\(22\)mda2 fixed ?
- vendor:cisco ios affected = 12.4\(22\)mda3 fixed ?
- vendor:cisco ios affected = 12.4\(22\)mda4 fixed ?
- vendor:cisco ios affected = 12.4\(22\)mda5 fixed ?
- vendor:cisco ios affected = 12.4\(22\)mda6 fixed ?
- vendor:cisco ios affected = 12.4\(22\)t fixed ?
- vendor:cisco ios affected = 12.4\(22\)t1 fixed ?
- vendor:cisco ios affected = 12.4\(22\)t2 fixed ?
- vendor:cisco ios affected = 12.4\(22\)t3 fixed ?
- vendor:cisco ios affected = 12.4\(22\)t4 fixed ?
- vendor:cisco ios affected = 12.4\(22\)t5 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr1 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr2 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr3 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr4 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr5 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr6 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr7 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr8 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr9 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr10 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr11 fixed ?
- vendor:cisco ios affected = 12.4\(22\)xr12 fixed ?
- vendor:cisco ios affected = 12.4\(24\)md fixed ?
- vendor:cisco ios affected = 12.4\(24\)md1 fixed ?
- vendor:cisco ios affected = 12.4\(24\)md2 fixed ?
- vendor:cisco ios affected = 12.4\(24\)md3 fixed ?
- vendor:cisco ios affected = 12.4\(24\)md4 fixed ?
- vendor:cisco ios affected = 12.4\(24\)md5 fixed ?
- vendor:cisco ios affected = 12.4\(24\)md6 fixed ?
- vendor:cisco ios affected = 12.4\(24\)md7 fixed ?
- vendor:cisco ios affected = 12.4\(24\)mda1 fixed ?
- vendor:cisco ios affected = 12.4\(24\)mda2 fixed ?
- vendor:cisco ios affected = 12.4\(24\)mda3 fixed ?
- vendor:cisco ios affected = 12.4\(24\)mda4 fixed ?

## Fix

Apply the mitigation from Cisco's vendor advisory, or stop using the affected product if no mitigation exists (per CISA required action). Fixed versions: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-20109

## From the sources

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.

 This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_