CVE-2023-26463

Katalog CVE

CVSS 9.8 · Critical EPSS 2,3%

Kerentanan Improper Certificate Validation pada strongswan. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.

Rincian

Terbit di NVD

15 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation
CWE-476: NULL Pointer Dereference

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-%28cve-2023-26463%29.html mitigasi · advisory vendor
• https://github.com/strongswan/strongswan/releases release notes
• https://security.netapp.com/advisory/ntap-20230517-0010/