VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 31, 2022· Updated Aug 4, 2024

CVE-2021-45079

CVE-2021-45079

Description

A missing check in strongSwan's EAP client code lets a rogue server send an early EAP-Success, bypassing client and potentially server authentication, or causing denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing check in strongSwan's EAP client code lets a rogue server send an early EAP-Success, bypassing client and potentially server authentication, or causing denial of service.

Vulnerability

In strongSwan before version 5.9.5, the EAP client code incorrectly handles early EAP-Success messages. When using EAP authentication (RFC 3748), the protocol expects a specific sequence of messages; an early EAP-Success sent by a responder before proper authentication causes the client to either crash the IKE daemon or conclude the EAP method prematurely. This affects all strongSwan versions since 4.1.2, depending on the configuration [1].

Exploitation

An attacker acting as a malicious VPN responder (server) can send an EAP-Success message before the EAP authentication exchange is complete, without having actually authenticated the client. No prior authentication or special privileges are required beyond network position to act as a rogue server. The exploitation can be triggered without user interaction beyond the client initiating an IKE_AUTH exchange [1].

Impact

In configurations using EAP-only authentication for IKEv2 or EAP methods with mutual authentication, a successful attack can bypass client authentication and, in some scenarios, even server authentication. This leads to unauthorized access to the VPN or resource, compromising confidentiality and integrity. Alternatively, the early message can cause a denial-of-service by crashing the IKE daemon [1].

Mitigation

strongSwan version 5.9.5 fixes the vulnerability. Users should update to 5.9.5 or later. If upgrading is not immediately possible, no workaround has been disclosed in the available references [1].

References
  1. strongSwan - strongSwan Vulnerability (CVE-2021-45079)

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

42

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

1

News mentions

0

No linked articles in our index yet.