Cisco urges to patch actively exploited IOS 0-day CVE-2023
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20109 | Out-of-Bounds Write in Cisco IOS/IOS XE GET VPN Enables Authenticated RCE CVE-2023-20109 is an out-of-bounds write (CWE-787) in the Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS and Cisco IOS XE, caused by insufficient validation of Group Domain of Interpretation (GDOI) and G-IKEv2 protocol attributes. An authenticated, remote attacker with administrative control of either a GET VPN group member or key server can trigger the flaw by compromising the installed key server or by modifying a group member's configuration to point at an attacker-controlled key server, then sending crafted GDOI/G-IKEv2 attributes. A successful exploit allows the attacker to execute arbitrary code and gain full control of the device, or to crash/reload it, causing a denial-of-service condition. Only organizations running Cisco IOS/IOS XE devices with the GET VPN feature configured (as group members or key servers) are affected; CVSS 3.1 rates it 6.6 (medium) because exploitation requires high privileges and high attack complexity. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-10-10, indicating confirmed in-the-wild exploitation, while EPSS estimates a 2.3% probability of exploitation in the next 30 days and no public PoC is known. Do: Upgrade affected devices to a fixed release identified in Cisco's security advisory, and inventory GET VPN deployments with 'show crypto gdoi' to identify group members and their key servers. Because exploitation requires a compromised or attacker-controlled key server, harden and restrict access to key servers, verify that group member configurations point only to legitimate key servers, and rotate GET VPN keys if compromise is suspected. Per the CISA KEV required action, apply vendor mitigations promptly or discontinue use where mitigations are unavailable. | 6.6 | 2% | KEV |
| largeon the order of tens of thousands of devices (GET VPN group members/key servers within Cisco's multi-million-unit IOS/IOS XE installed base; not typically… |
Full article426 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 28, 2023
Cisco released security updates for an actively exploited zero-day flaw (CVE-2023-20109) that resides in the GET VPN feature of IOS and IOS XE software.
Cisco warned customers to install security updates to address an actively exploited zero-day vulnerability, tracked as CVE-2023-20109 (CVS 6.6), that resides in IOS and IOS XE software.
The vulnerability resides in the Group Encrypted Transport VPN (GET VPN) feature of IOS and IOS XE. A remote attacker can trigger the vulnerability to gain arbitrary code execution. The issue can be exploited only by an attacker who has valid credentials and administrative control over a group member or a key server.
“A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.” reads the advisory published by the IT giant. “This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details section of this advisory.”
The flaw affects products if they are running a vulnerable release of Cisco IOS Software or Cisco IOS XE Software and have the GDOI or G-IKEv2 protocol enabled.
“Cisco discovered attempted exploitation of the GET VPN feature and conducted a technical code review of the feature. This vulnerability was discovered during our internal investigation.” continues the advisory. “Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.”
This vulnerability was discovered by X. B. of the Cisco Advanced Security Initiatives Group (ASIG) during an internal investigation.
The company urges customers to upgrade to a fixed software release to address this vulnerability and warns that there are no workarounds that address this flaw.
Cisco confirmed that this vulnerability does not affect the following products:
- IOS XR Software
- Meraki products
- NX-OS Software
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2023-20109)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/151647/hacking/cisco-cve-2023-20109-actively-exploited.html