VulnerabilityModified
CVE-2005-2025
Cisco VPN 3000 Concentrator before 4.1.7.F allows remote attackers to determine valid groupnames by sending an IKE Aggressive Mode packet with the groupname in the ID field, which generates a response if the groupname is valid, but does not generate a…
MEDIUM 5.0EPSS 2.34%
Does this matter?
Lower severity and a low EPSS score (2.34%). Track it; it rarely justifies an emergency change on its own.
Description
Cisco VPN 3000 Concentrator before 4.1.7.F allows remote attackers to determine valid groupnames by sending an IKE Aggressive Mode packet with the groupname in the ID field, which generates a response if the groupname is valid, but does not generate a response for an invalid groupname.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.34% probability · 83th percentile
- CISA KEV
- Not listed
- Affected
- cisco/vpn 3000 concentrator · cisco/vpn 3015 concentrator · cisco/vpn 3020 concentrator · cisco/vpn 3030 concentator · cisco/vpn 3060 concentrator · cisco/vpn 3080 concentrator · cisco/vpn 3000 concentrator series software · cisco/vpn 3005 concentrator software
- Source
- cve@mitre.org
References
- http://www.nta-monitor.com/news/vpn-flaws/cisco/VPN-Concentrator/index.htmExploit, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/13992Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2005/0822
- http://www.nta-monitor.com/news/vpn-flaws/cisco/VPN-Concentrator/index.htmExploit, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/13992Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2005/0822
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.