VULNERABILITY INTELLIGENCE

CVE-2010-2628

CVSS score7.5 HIGH
EPSS probability4.05%
CISA KEVNot currently listed
Published2010-08-20
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Description

The IKE daemon in strongSwan 4.3.x before 4.3.7 and 4.4.x before 4.4.1 does not properly check the return values of snprintf calls, which allows remote attackers to execute arbitrary code via crafted (1) certificate or (2) identity data that triggers buffer overflows.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references