VULNERABILITY INTELLIGENCE

CVE-2015-4171

CVSS score2.6 LOW
EPSS probability2.03%
CISA KEVNot currently listed
Published2015-06-10
Last modified2026-06-17
CVSS vectorAV:N/AC:H/Au:N/C:P/I:N/A:N

Description

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references