CVE-2023-26463 is a critical remote code execution vulnerability affecting strongSwan versions 5.9.8 and 5.9.9, stemming from a variable reuse error and subsequent expired pointer dereference. This flaw, with a CVSS score of 9.8, allows unauthenticated attackers to achieve full compromise (confidentiality, integrity, availability) by sending a crafted client certificate during EAP-TLS, specifically impacting servers configured with TLS-based EAP methods. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community attention, with 11 mentions and a high EPSS score, indicating a higher-than-average likelihood of future exploitation. A patch is available in strongSwan 5.9.10.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.9.8CPE matchmatch criteria | cpe:2.3:a:strongswan:strongswan:5.9.8:-:*:*:*:*:*:* | ||
5.9.9CPE matchmatch criteria | cpe:2.3:a:strongswan:strongswan:5.9.9:-:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-26463
May 9, 2023strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS EAP-TTLS EAP-PEAP or EAP-TNC). This is fixed in 5.9.10.
Apr 11, 2023