Is CVE-2023-20109 being actively exploited?

Yes. CVE-2023-20109 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on October 10, 2023.

What is the CVSS score for CVE-2023-20109?

CVE-2023-20109 has a CVSS 3.1 base score of 6.6 (MEDIUM).

CVE-2023-20109

MEDIUM · CVSS 6.6CISA KEV: actively exploitedEPSS 2.5%EU EUVD: exploited

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.

Key facts

CVSS score: 6.6 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
EPSS score: 2.5% (84th percentile)
In CISA KEV: Yes, added October 10, 2023
In EU EUVD: Yes (EUVD-2023-24288)
Published: September 27, 2023
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

Added to the KEV catalog on October 10, 2023; federal remediation due October 31, 2023.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2023-24288 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios
cisco / ios

and 950 more…

Certified products that may be affected

6 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Catalyst 3K/4K Wired Access Switches running IOS-XE 3.8.0E - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-10688-2016 - archived
Cisco Aggregation Services Router (ASR) 1000 Series, IOS XE 3.13 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-10609-2015 - archived
Cisco Integrated Services Router 4400 Series (ISR-4400), IOS XE 3.13.0 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-10600-2015 - archived
Cisco Catalyst 3850 Series Switches running IOS-XE 3.6.0E and Catalyst 6500 Series Switches running IOS 15.1(2)SY3 - Cisco Systems, Inc. - Common Criteria NSCIB-CC-14-39582-CR - archived
Cisco Integrated Services Routers Series (ISR-4400), IOS XE 3.10.2tS - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-10553-2014 - archived

See all 6 in the Security Certifications Explorer.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20109(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain