Description
Cisco VPN 3000 Concentrator before 4.1.7.F allows remote attackers to determine valid groupnames by sending an IKE Aggressive Mode packet with the groupname in the ID field, which generates a response if the groupname is valid, but does not generate a response for an invalid groupname.
References (3)
Core 3
Core References
Exploit, Patch, Vendor Advisory x_refsource_misc
http://www.nta-monitor.com/news/vpn-flaws/cisco/VPN-Concentrator/index.htm
Patch, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/13992
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2005/0822
Scores
EPSS
0.0234
EPSS Percentile
81.9%
Details
Status
published
Products (44)
cisco/vpn_3000_concentrator
cisco/vpn_3000_concentrator_series_software
2.0
cisco/vpn_3000_concentrator_series_software
2.5.2.a
cisco/vpn_3000_concentrator_series_software
2.5.2.b
cisco/vpn_3000_concentrator_series_software
2.5.2.c
cisco/vpn_3000_concentrator_series_software
2.5.2.d
cisco/vpn_3000_concentrator_series_software
2.5.2.f
cisco/vpn_3000_concentrator_series_software
3.0
cisco/vpn_3000_concentrator_series_software
3.0.3.a
cisco/vpn_3000_concentrator_series_software
3.0.3.b
... and 34 more
Published
Jun 20, 2005
Tracked Since
Feb 18, 2026