VulnRadar

Data against noise.

Page generated: 11 Nov 2026, 12:20 UTC

CVE-2023-20109

Read full description

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.

CVSS 6.6 (MEDIUM) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.0/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 6.6: +0.99
Fresh EPSS: 2.50%: +0.01

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

SecurityWeek

Press · 24 Apr 2024, 07:00 · Cisco Raises Alarm for ‘ArcaneDoor’ Zero-Days Hitting ASA Firewall Platforms - SecurityWeek

BleepingComputer

Press · 20 Oct 2023, 07:00 · Cisco discloses new IOS XE zero-day exploited to deploy malware implant - BleepingComputer

BleepingComputer

Press · 17 Oct 2023, 07:00 · Over 10,000 Cisco devices hacked in IOS XE zero-day attacks - BleepingComputer

The Register

Press · 16 Oct 2023, 07:00 · Cisco zero-day bug allows router hijacking and is being actively exploited - The Register

BleepingComputer

Press · 04 Oct 2023, 07:00 · Cisco fixes hard-coded root credentials in Emergency Responder - BleepingComputer

See all 10 source documents

The Record from Recorded Future News

Press · 02 Oct 2023, 07:00 · Cisco warns of attempted exploitation of zero-day in VPN software - The Record from Recorded Future News

CISO Series

Press · 29 Sep 2023, 07:00 · Gov't email damage, Johnson Controls attacked, Google’s 5th zero-day - CISO Series

TechTarget

Press · 28 Sep 2023, 07:00 · Cisco patches zero-day vulnerability under attack - TechTarget

SecurityWeek

Press · 27 Sep 2023, 07:00 · Chinese Gov Hackers Caught Hiding in Cisco Router Firmware - SecurityWeek

SecurityWeek

Press · 19 Apr 2023, 07:00 · US, UK: Russia Exploiting Old Vulnerability to Hack Cisco Routers - SecurityWeek

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.0 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 6.6; EPSS 2.5%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, high privileges, no user interaction, additional attack conditions.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:48.602448+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

19 Apr 2023, 07:00

Published

27 Sep 2023, 17:23

Added to the CISA KEV catalog

10 Oct 2023, 00:00

Latest press mention

24 Apr 2024, 07:00

Score calculated

05 Nov 2026, 13:58