PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication

bishopfox.com | vulnerability | High | CVE-2026-25075 | #vulnerability-research | #denial-of-service | #integer-underflow | #vpn | #strongswan | #cve-2026-25075 | #eap-ttls
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox exploited CVE-2026-25075, an integer underflow in strongSwan's EAP-TTLS plugin (4.5.0-6.0.4): crafted messages crash the IKE daemon via two-phase heap corruption; upgrade to 6.0.5+.
CVE
CVE-2026-25075
CVSS
7.5
Published
Collected

Related coverage

High · vulnerability · bishopfox.com
A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318
Bishop Fox confirms CVE-2026-28318: one unauthenticated POST with a deflate Content-Encoding crashes SolarWinds Serv-U via heap corruption, but three probed RCE paths dead-end; HF1 fixes it.
vulnerability · bishopfox.com
It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable
Bishop Fox found 178,637 of 233,984 internet-exposed SonicWall NGFW devices (76%) vulnerable to CVE-2022-22274 and CVE-2023-0656, unauthenticated DoS issues sharing one root cause; upgrade urged.
vulnerability · bishopfox.com
eCatcher Desktop, Version 6.6.4 Advisory
Advisory on CVE-2021-33214 in eCatcher 6.6.4 and earlier: a world-writable service temp directory lets a local attacker swap in a rogue OpenVPN config for privilege escalation; fixed in 6.7.3.
vulnerability · blog.quarkslab.com
Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)
Local privilege escalation in the Cato VPN Client through the split-tunnel upload flow, from named pipe to SYSTEM delete and Windows Installer rollback.
vulnerability · blog.trailofbits.com
Numbers turned weapons: DoS in Osmosis’ math library
Trail of Bits discloses a DoS in Osmosis' math library: an unbounded Taylor-series loop in PowApprox lets crafted transactions burn seconds of compute for little gas, enough to halt the chain.
vulnerability · blog.quarkslab.com
Remote Denial-of-Service on CycloneTCP : CVE-2021-26788
A vulnerability report on CVE-2021-26788, a remotely triggerable denial-of-service in the CycloneTCP embedded TCP/IP stack caused by zero-length TCP options causing an infinite loop; fixed in 2.0.2.
Back