Skip to content
Fencer Intel
medium 5.0

CVE-2015-8023 json

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not pr…

published 2015-11-18 10 y ago modified 2026-06-17 4 mo ago also EUVD-2015-7918

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.

Patch / fix

  • strongswan Debian 14, Debian 13, Debian 12 5.3.3-3

debian advisories DEBIAN-CVE-2015-8023

  • strongswan Ubuntu 14.04 LTS 5.1.2-0ubuntu2.4
  • strongswan Ubuntu 16.04 LTS 5.1.2-0ubuntu7

ubuntu advisories UBUNTU-CVE-2015-8023

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • strongswan SLES 12 SP1, SLES 12, SLED 12 SP1 +3 more 5.1.3-22.1
  • strongswan SLES for SAP 11 SP4, SLES for SAP 11 SP3, SLES 11 SP4 +4 more 4.4.0-6.32.1

suse advisories SUSE-SU-2015:2183-1SUSE-SU-2015:2183-2SUSE-SU-2015:2186-1

  • strongswan openSUSE Tumbleweed 5.3.5-1.1

opensuse advisories openSUSE-SU-2024:10579-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-8023 updated cvss 6.4

strongswan: Authentication bypass in eap-mschapv2 plugin

  • Red Hat Enterprise Linux 7 strongimcv
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.58% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.