CVE-2002-0666

CVE-2002-0666 describes a denial-of-service vulnerability affecting IPSEC implementations, including FreeS/WAN and KAME, as well as products from Apple, FreeBSD, and NetBSD. The flaw stems from improper calculation of authentication data length, leading to integer signedness errors when processing spoofed, short Encapsulating Security Payload (ESP) packets. This can result in a kernel panic. The vulnerability has a CVSS score of 5.0, indicating a medium severity. It is easily exploitable remotely over the network with low attack complexity and no authentication required, leading to a complete loss of availability (denial of service). There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or community discussion has been identified. The CVE is not listed on the CISA KEV catalog and is considered inactive on the Hot List.