CVE-2023-20109

What it actually does

This vulnerability affects the Cisco Group Encrypted Transport VPN (GET VPN) feature in Cisco IOS and Cisco IOS XE. It stems from insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols, which can lead to memory corruption, specifically an out-of-bounds write condition. An authenticated remote attacker with administrative control of either a GET VPN group member or key server can send malicious protocol attributes that cause arbitrary code execution on an affected router or cause the device to reload, resulting in denial of service. Successful code execution can give the attacker full control of the affected network device.

Why it matters to the business

Compromise of an affected Cisco IOS or IOS XE device can disrupt encrypted WAN connectivity, routing, branch communications, and site-to-site traffic that depends on GET VPN. Because successful exploitation can provide full control of network infrastructure, an attacker may be able to intercept or redirect traffic, disable network services, establish persistence on routers, or use the device as a foothold for broader intrusion. This vulnerability is listed in CISA KEV and has active in-the-wild exploitation, with a federal remediation deadline of 2023-10-31, so organizations should treat remaining exposure as high priority even though exploitation requires privileged access to a GET VPN role.

How an attack unfolds

An attacker first needs a privileged position within a GET VPN deployment: either administrative control of a legitimate key server or control of a group member configuration that can be pointed to a malicious key server. From that position, the attacker crafts malicious GDOI or G-IKEv2 protocol attributes and causes an affected Cisco IOS or IOS XE device participating in GET VPN to process them. Because the device does not sufficiently validate those attributes, parsing the malicious data can corrupt memory. Depending on exploit reliability and platform details, this can either crash and reload the device or allow arbitrary code execution with the privileges of the network operating system, effectively giving the attacker full control of the router or switch. In observed-risk terms, this is a post-compromise or insider-adjacent attack path against GET VPN control-plane trust relationships rather than a simple unauthenticated internet scan-and-exploit vulnerability.

How to fix it

Upgrade affected Cisco IOS and Cisco IOS XE releases to a Cisco-provided fixed software release as identified by Cisco Software Checker or the relevant Cisco security advisory for the exact platform and train. No universal fixed version applies across all IOS and IOS XE platforms, so remediation must be mapped by hardware model, current software train, and feature set. If immediate upgrade is not possible, reduce exposure by disabling GET VPN where it is not required, removing unused key server or group member configurations, restricting administrative access to network devices, and ensuring GET VPN peers and key servers are explicitly trusted and monitored. Rotate credentials and review trust relationships if a key server or group member may have been compromised. Because this is a KEV-listed vulnerability with known exploitation, temporary mitigations should not be treated as a substitute for upgrading.

How to confirm the fix worked

Confirm whether each Cisco IOS and IOS XE device runs an affected release and whether GET VPN is configured. Use Cisco Software Checker and the advisory-specific fixed-release guidance to verify that the installed version is not vulnerable. Validate configuration by reviewing GET VPN/GDOI/G-IKEv2 key server and group member settings, confirming that group members point only to authorized key servers, and ensuring there are no unexpected key server addresses. After remediation, verify that devices no longer run vulnerable images, GET VPN tunnels function as expected, and there are no unexpected reloads, crashinfo files, or GDOI/G-IKEv2 errors. Where possible, perform configuration compliance checks against approved GET VPN topology and authorized administrative access paths.

Typical attack path

1. Identify Cisco IOS or IOS XE devices using the GET VPN feature and participating as group members or key servers.
2. Obtain administrative control of a GET VPN key server, or gain administrative ability to modify a group member configuration.
3. If controlling a group member, change the GET VPN configuration so the device points to an attacker-controlled key server.
4. Send malformed or malicious GDOI or G-IKEv2 attributes to the affected device during GET VPN control-plane exchanges.
5. Trigger insufficient attribute validation and memory corruption on the target device.
6. Cause the target device to reload for denial of service, or achieve arbitrary code execution and take full control of the affected network device.
7. Use the compromised device to disrupt encrypted transport, alter routing or VPN behavior, monitor or redirect traffic, or pivot further into the network.

How to detect it

Look for evidence that an attacker gained administrative control of GET VPN infrastructure or manipulated GET VPN trust relationships before the device crashed or behaved abnormally. Primary sources include Cisco IOS/IOS XE syslog, AAA/TACACS+/RADIUS accounting, configuration archives, NetFlow or firewall logs for management access, SNMP traps, crashinfo files, core dumps, and NOC monitoring events for unexpected reloads. Search for configuration changes involving GET VPN, GDOI, G-IKEv2, key servers, group members, or crypto map/policy changes. Pay particular attention to group members that were reconfigured to use an unknown key server or key servers that began sending abnormal GDOI/G-IKEv2 traffic. Investigate unexpected reloads, bus errors, software-forced crashes, memory corruption messages, traceback output, or repeated GET VPN registration failures. Because exploitation requires privileged GET VPN positioning, correlate protocol anomalies with administrative logins, configuration mode activity, newly added admin accounts, changes from unusual source IP addresses, and changes made outside approved maintenance windows. Threat context is active exploitation of the Cisco IOS and IOS XE GET VPN out-of-bounds write vulnerability; detection should focus on pre-exploitation administrative compromise as well as post-exploitation router instability or unauthorized control-plane changes.

• GETVPN
• GET VPN
• GDOI
• G-IKEv2
• crypto gdoi
• crypto gdoi group
• server address ipv4
• key server
• group member
• %GDOI
• %GDOI-
• %CRYPTO-
• %CRYPTO-4-RECVD_PKT_INV_SPI
• %CRYPTO-6-GDOI_ON_OFF
• %CRYPTO-6-IKMP_MODE_FAILURE
• %SYS-5-CONFIG_I
• %SYS-5-RELOAD
• %SYS-2-MALLOCFAIL
• %SYS-2-CHUNKBOUNDSIBLING
• %SYS-2-CHUNKBADMAGIC
• %SYS-3-CPUHOG
• %SYS-3-LOGGER_FLUSHING
• %Software-forced reload
• System returned to ROM by error
• System returned to ROM by reload
• Traceback=
• crashinfo:
• flash:crashinfo
• bootflash:crashinfo

What your security team should do

• Inventory Cisco IOS and IOS XE devices and identify all systems with GET VPN, GDOI, or G-IKEv2 GET VPN configurations enabled.
• Prioritize upgrades for any affected GET VPN key servers and group members, using Cisco’s platform-specific fixed-release guidance.
• Treat this as urgent because it is in CISA KEV, has active in-the-wild exploitation, and the remediation deadline has passed.
• Audit GET VPN configurations for unauthorized or unexpected key server addresses, group member changes, and recent administrative modifications.
• Review network device AAA logs for administrative access by unusual accounts, source IPs, or times, especially around GET VPN configuration changes.
• Investigate unexpected device reloads, crashinfo files, memory corruption messages, or GDOI/G-IKEv2 control-plane anomalies on affected devices.
• Restrict management-plane access to Cisco devices using ACLs, MFA-backed administration where supported, TACACS+/RADIUS logging, and dedicated management networks.
• If compromise is suspected, preserve device logs and crash artifacts, rotate administrative credentials and GET VPN-related keys, rebuild or reimage affected devices where feasible, and validate neighboring network trust relationships.