CVE-2023-20109

CVE-2023-20109 is an out-of-bounds write vulnerability affecting Cisco IOS and IOS XE Software's Group Encrypted Transport VPN (GET VPN) feature. An authenticated, remote attacker with administrative control over a group member or key server can exploit insufficient validation in GDOI and G-IKEv2 protocols. This allows for arbitrary code execution or a denial-of-service condition. The vulnerability has a CVSS score of 6.6 (Medium), but a FAUCET Risk Score of 98/100, indicating a high practical risk. Exploitation requires high privileges (PR:H) and high attack complexity (AC:H), but successful attacks can lead to full system compromise (C:H, I:H, A:H). This CVE is actively exploited in the wild, as confirmed by its presence in the CISA KEV catalog. While no public exploit code is available via Metasploit, Nuclei, or ExploitDB, it has garnered significant community discussion and media coverage, highlighting its critical nature.