How severe is CVE-2013-6076?

CVE-2013-6076 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2013-6076 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2013-6076?

CVE-2013-6076 primarily affects Strongswan. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2013-6076?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2013-6076 published?

CVE-2013-6076 was published on 2013-11-02 and last updated on 2026-06-16.

CVE-2013-6076

CVE-2013-6076 is a medium-severity vulnerability in Strongswan with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 2% (77th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Strongswan
Published: 2013-11-02
Last modified: 2026-06-16

Description

strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a crafted IKEv1 fragmentation packet.

Frequently asked questions

What is CVE-2013-6076?: strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a crafted IKEv1 fragmentation packet.
How severe is CVE-2013-6076?: CVE-2013-6076 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2013-6076 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2013-6076?: CVE-2013-6076 primarily affects Strongswan. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2013-6076?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2013-6076 published?: CVE-2013-6076 was published on 2013-11-02 and last updated on 2026-06-16.

References

http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html

Affected products (4)

cpe:2.3:a:strongswan:strongswan:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:strongswan:strongswan:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:strongswan:strongswan:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:strongswan:strongswan:5.1.0:*:*:*:*:*:*:*

More vulnerabilities in Strongswan

CVE-2004-0590 — Critical (CVSS 10.0): FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x…
CVE-2023-41913 — Critical (CVSS 9.8): strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value…
CVE-2023-26463 — Critical (CVSS 9.8): strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two…
CVE-2015-3991 — Critical (CVSS 9.8): strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary…
CVE-2021-45079 — Critical (CVSS 9.1): In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually…
CVE-2022-4967 — High (CVSS 7.7): strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate…

All CVEs affecting Strongswan →