VULNERABILITY INTELLIGENCE
CVE-2021-45079
CVSS score9.1 CRITICAL
EPSS probability2.76%
CISA KEVNot currently listed
Published2022-01-31
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Description
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
Weakness classification
- nvd@nist.gov: CWE-476