CVE-2015-4171

CVE-2015-4171 is a low-severity vulnerability in Strongswan Strongswan Vpn Client with a CVSS 2.0 base score of 2.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-200.

Key facts

• Severity: Low (CVSS 2.0 base score 2.6)
• EPSS exploit prediction: 2% (79th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-200
• Affected product: Strongswan Strongswan Vpn Client
• Published: 2015-06-10
• Last modified: 2026-06-17

Description

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Frequently asked questions

What is CVE-2015-4171?

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

How severe is CVE-2015-4171?

CVE-2015-4171 has a CVSS 2.0 base score of 2.6, rated low severity.

Is CVE-2015-4171 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-4171?

CVE-2015-4171 primarily affects Strongswan Strongswan Vpn Client. In total, 39 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-4171?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-4171 published?

CVE-2015-4171 was published on 2015-06-10 and last updated on 2026-06-17.

References

• http://lists.opensuse.org/opensuse-updates/2015-06/msg00040.html
• http://www.debian.org/security/2015/dsa-3282
• http://www.openwall.com/lists/oss-security/2015/05/29/6
• http://www.openwall.com/lists/oss-security/2015/05/29/7
• http://www.openwall.com/lists/oss-security/2015/06/08/4
• http://www.securityfocus.com/bid/74933
• http://www.securitytracker.com/id/1032514
• http://www.ubuntu.com/usn/USN-2628-1
• https://bugzilla.suse.com/show_bug.cgi?id=933591
• https://play.google.com/store/apps/details?id=org.strongswan.android
• https://www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-%2528cve-2015-4171%2529.html
• https://www.suse.com/security/cve/CVE-2015-4171.html

Affected products (39)

• cpe:2.3:a:strongswan:strongswan_vpn_client:*:*:*:*:*:android:*:*
• cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.4:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.5:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.6:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.7:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.4.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.5.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.5.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.5.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.5.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.6.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.6.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.6.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.6.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.6.4:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.1.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.1.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:5.3.1:*:*:*:*:*:*:*

Other CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities

• CVE-2026-27604 — Critical (CVSS 10.0): FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version…
• CVE-2026-40965 — Critical (CVSS 10.0): Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a…
• CVE-2026-42826 — Critical (CVSS 10.0): Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose…
• CVE-2025-29270 — Critical (CVSS 10.0): Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows…
• CVE-2025-61481 — Critical (CVSS 10.0): An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by…
• CVE-2025-53624 — Critical (CVSS 10.0): The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user.…

Browse all CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities →