CVE-2014-2338

CVE-2014-2338 is a medium-severity vulnerability in Strongswan with a CVSS 2.0 base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.

Key facts

• Severity: Medium (CVSS 2.0 base score 6.4)
• EPSS exploit prediction: 2% (82nd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-287
• Affected product: Strongswan
• Published: 2014-04-16
• Last modified: 2026-06-17

Description

IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.

Frequently asked questions

What is CVE-2014-2338?

IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.

How severe is CVE-2014-2338?

CVE-2014-2338 has a CVSS 2.0 base score of 6.4, rated medium severity.

Is CVE-2014-2338 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-2338?

CVE-2014-2338 primarily affects Strongswan. In total, 57 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-2338?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2014-2338 published?

CVE-2014-2338 was published on 2014-04-16 and last updated on 2026-06-17.

References

• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00010.html
• http://lists.opensuse.org/opensuse-updates/2014-05/msg00064.html
• http://lists.opensuse.org/opensuse-updates/2014-05/msg00066.html
• http://secunia.com/advisories/57823
• http://www.debian.org/security/2014/dsa-2903
• http://www.securityfocus.com/bid/66815
• http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html

Affected products (57)

• cpe:2.3:a:strongswan:strongswan:4.0.7:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.4:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.5:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.6:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.7:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.8:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.9:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.10:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1.11:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.4:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.5:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.6:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.7:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.8:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.9:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.10:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.11:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.12:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.13:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.14:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.15:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.16:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.4:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.5:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.6:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.7:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.4.1:*:*:*:*:*:*:*

More vulnerabilities in Strongswan

• CVE-2004-0590 — Critical (CVSS 10.0): FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x…
• CVE-2023-41913 — Critical (CVSS 9.8): strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value…
• CVE-2023-26463 — Critical (CVSS 9.8): strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two…
• CVE-2015-3991 — Critical (CVSS 9.8): strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary…
• CVE-2021-45079 — Critical (CVSS 9.1): In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually…
• CVE-2022-4967 — High (CVSS 7.7): strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate…

All CVEs affecting Strongswan →

Other CWE-287 (Improper Authentication) vulnerabilities

• CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
• CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
• CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
• CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
• CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…

Browse all CWE-287 (Improper Authentication) vulnerabilities →