How severe is CVE-2006-1646?

CVE-2006-1646 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2006-1646 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-1646?

CVE-2006-1646 affects Internet Key Exchange. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2006-1646?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2006-1646 published?

CVE-2006-1646 was published on 2006-04-06 and last updated on 2026-06-16.

CVE-2006-1646

CVE-2006-1646 is a medium-severity vulnerability in Internet Key Exchange with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 2% (82nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Internet Key Exchange
Published: 2006-04-06
Last modified: 2026-06-16

Description

The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in the Shoichi Sakane KAME Project racoon, as used by NetBSD 1.6, 2.x before 20060119, certain FreeBSD releases, and possibly other distributions of BSD or Linux operating systems, when running in aggressive mode, allows remote attackers to cause a denial of service (daemon crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

Frequently asked questions

What is CVE-2006-1646?: The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in the Shoichi Sakane KAME Project racoon, as used by NetBSD 1.6, 2.x before 20060119, certain FreeBSD releases, and possibly other distributions of BSD or Linux operating systems, when running in aggressive mode, allows remote attackers to cause a denial of service (daemon crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
How severe is CVE-2006-1646?: CVE-2006-1646 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2006-1646 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-1646?: CVE-2006-1646 affects Internet Key Exchange. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2006-1646?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2006-1646 published?: CVE-2006-1646 was published on 2006-04-06 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:internet_key_exchange:internet_key_exchange:1:*:*:*:*:*:*:*

More vulnerabilities in Internet Key Exchange

CVE-2005-3666 — Critical (CVSS 10.0): Multiple unspecified format string vulnerabilities in multiple unspecified implementations of Internet Key Exchange…
CVE-2006-2298 — Medium (CVSS 5.0): The Internet Key Exchange version 1 (IKEv1) implementation in the libike library in Solaris 9 and 10 allows remote…
CVE-2005-3668 — Medium (CVSS 5.0): Multiple buffer overflows in multiple unspecified implementations of Internet Key Exchange version 1 (IKEv1) have…
CVE-2005-3667 — Medium (CVSS 5.0): Multiple unspecified vulnerabilities in multiple unspecified implementations of Internet Key Exchange version 1 (IKEv1)…

All CVEs affecting Internet Key Exchange →