CVE-2025-44649
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-08-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trendnet | tew-wlc100p_firmware | 2.03b03 |
| trendnet | tew-wlc100p | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is due to the use of 'aggressive' mode in the IKE Phase 1 configuration of the racoon IPsec key management daemon on the TRENDnet TEW-WLC100P device. Aggressive mode exposes identity information in plaintext, making it vulnerable to offline dictionary attacks. It also lacks flexibility in negotiating security parameters compared to the more secure 'main' mode. [1]
How can this vulnerability impact me? :
The vulnerability can lead to exposure of identity information in plaintext during the IKE Phase 1 negotiation, which attackers can exploit to perform offline dictionary attacks to recover pre-shared keys. This compromises the security of the VPN connection, potentially allowing unauthorized access or interception of sensitive communications. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting the racoon configuration file, typically located at /etc/racoon.conf, to check if the 'exchange_mode' is set to 'aggressive' in the IKE Phase 1 settings. For example, you can use the command: `grep exchange_mode /etc/racoon.conf` to find the exchange_mode setting. If it shows 'exchange_mode aggressive,main;', the system is vulnerable. Additionally, monitoring network traffic for IKE Phase 1 exchanges in aggressive mode can help detect this vulnerability, but the primary detection method is configuration inspection. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately change the 'exchange_mode' setting in the racoon configuration file (/etc/racoon.conf) from 'aggressive' to 'main' mode. Main mode does not expose identity information in plaintext and is more secure against offline dictionary attacks. After modifying the configuration, restart the racoon service to apply the changes. Additionally, review and update any related security parameters to ensure they follow best practices. [1]