5.9

CVE-2018-5389: ietf internet_key_exchange Weak Password Requirements

CVSS: 5.9v3.0MediumModified
AliasesUBUNTU-CVE-2018-5389DEBIAN-CVE-2018-5389
Published 06-09-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-5389 is a medium (CVSS 5.9) Weak Password Requirements vulnerability in ietf internet_key_exchange. EPSS estimates a 3.04% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.0 (NVD)
EPSS score
3.04%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 06-09-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline dictionary or brute force attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. This vulnerability could allow an attacker to recover a weak Pre-Shared Key or enable the impersonation of a victim host or network.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

3.04%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

0.00 pp

From 3.04% on 18-09-2026

18-09-202618-10-2026
EPSS score
3.04%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (web-in-security.blogspot.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Ubuntu4 products
  • ipsec-toolsAll versions (No fix recorded)
  • isakmpdAll versions (No fix recorded)
  • libreswanAll versions (No fix recorded)
  • strongswanAll versions (No fix recorded)
Debian2 products
  • libreswanAll versions (No fix recorded)
  • strongswanAll versions (No fix recorded)
Ietf1 product
Strongswan1 product

4 vendors · 8 products

References

10 links