CVE-2015-4171

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection…

published June 10, 2015

CVSS
—
EPSS
2%
Percentile
80.9
In the wild
Unconfirmed
What it is

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02028 · 80.9th percentile
Published
2015-06-10T18:00Z
EPSS history
Timeline
  • 10 JUN 18:00Z
    strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection…
    cvelistv5