Vulnerability in Cisco Vpn 3000 Concentrator
CVE-2005-2025
Cisco VPN 3000 Concentrator before 4.1.7.F allows remote attackers to determine valid groupnames by sending an IKE Aggressive Mode packet with the groupname in the ID field, which generates a response if the groupname is valid, but does not generate a response for an invalid groupname.
EPSS: 0.023 (82.5th percentile) — read the EPSS interpretation.
Affected products
- Cisco Vpn_3000_concentrator
- Cisco Vpn_3000_concentrator_series_software — versions 3.1.4, 3.1.2, 3.5(rel)
- Cisco Vpn_3005_concentrator_software — versions 4.0.1
- Cisco Vpn_3015_concentrator
- Cisco Vpn_3020_concentrator
- Cisco Vpn_3030_concentator
- Cisco Vpn_3060_concentrator
- Cisco Vpn_3080_concentrator
- N/a — versions n/a
References
- cve@mitre.org (Exploit, Patch, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)