TheGreenBow VPN Client CVE-2025-11955
HIGHSeverity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-facing IKEv2 flaw with no auth or UI, but exploitation needs a revoked cert plus OCSP interference (AC:H); impact is confidential-traffic exposure only, so C:H, I:N, A:N.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
Lifecycle Timeline
3DescriptionCVE.org
Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.
AnalysisAI
Certificate-revocation-check bypass in TheGreenBow VPN Client for Windows 7.5 and 7.6 lets an unauthenticated remote attacker who can sit on the IKEv2 path complete a VPN tunnel even though the peer certificate should have failed revocation checking, because the client accepts a missing or invalidly-signed OCSP response as satisfactory. Exploitation requires OCSP checking to be enabled on the client plus an attacker who either holds a revoked certificate or can suppress/corrupt the OCSP responder reply, so the practical impact is a confidentiality breach (tunnel establishment with a certificate that should have been rejected) with no integrity or availability effect per the assessed vector. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and EPSS is low at 0.21% (10th percentile), reflecting the high attack complexity and present attack requirements rather than a trivial attack path.
Technical ContextAI
The flaw is rooted in CWE-299 (Improper Check for Certificate Revocation), specifically in how the TheGreenBow Windows client treats Online Certificate Status Protocol (OCSP) responses during IKEv2 authentication. OCSP is the real-time complement to CRL-based revocation checking: a client hashes the peer certificate's serial number and issuer into an OCSP request, sends it to a designated responder, and must verify the response's signature and validity window before trusting the 'good'/'revoked'/'unknown' status. Here the client's validation logic is incorrect - it proceeds to establish the IPsec/IKEv2 tunnel when the OCSP response is absent or carries an invalid signature, effectively degrading 'fail-closed' revocation enforcement to 'fail-open'. This is a client-side trust-decision defect in the VPN endpoint, not a flaw in the IKEv2 protocol or the OCSP responder itself; because the affected code sits in the certificate-path validation step of the VPN client, the security guarantee normally provided by OCSP (that a revoked peer credential cannot authenticate) is silently lost. The environment is Windows-only, versions 7.5 and 7.6, and the behavior only manifests when OCSP-based revocation checking has been enabled by the administrator or user; clients operating without OCSP are outside the affected path. The assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N confirms a network-reachable, unauthenticated condition whose success is gated by nontrivial preconditions (AC:H), with confidentiality impact only.
Affected ProductsAI
The affected product is the TheGreenBow VPN Client for Windows, specifically versions 7.5 and 7.6, as stated in the vendor/INCIBE advisory. No CPE strings were supplied in the provided intelligence, so the version-based identification above should be treated as the authoritative scope rather than a CPE match; other TheGreenBow products and client builds outside the 7.5/7.6 Windows line are not identified as affected. Vendor and national CERT guidance are available at https://www.thegreenbow.com/en/support/security-alerts/ (TheGreenBow security alerts page) and https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-validation-ocsp-certificates-thegreenbow-vpn-client-windows (INCIBE-CERT advisory covering the incorrect OCSP certificate validation in the Windows VPN client). Administrators should map their installed client build numbers against these advisories to confirm exposure.
RemediationAI
Patch status should be confirmed directly against the vendor security alerts page at https://www.thegreenbow.com/en/support/security-alerts/ and the INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-validation-ocsp-certificates-thegreenbow-vpn-client-windows, as the provided data does not include a specific fixed release number - deployment of the latest available 7.5/7.6 maintenance build (or migration off the affected 7.5/7.6 line) is the primary action, and organizations should verify the fixed version with TheGreenBow support before treating an endpoint as remediated. Where immediate upgrading is not possible, compensating controls must target the fail-open behavior rather than generic hardening: restrict the IKEv2 peer trust to an explicit allow-list of certificate fingerprints or subject identities so that a revoked-but-still-presented credential cannot complete the handshake (trade-off: operational overhead and breakage whenever legitimate peer certificates rotate), and/or disable OCSP on affected clients and rely on CRL-based revocation checking instead (trade-off: CRL freshness and delivery windows are generally weaker than OCSP, and a CRL fetch can itself be blocked, so this shifts rather than eliminates the blind spot). Because the attacker needs a revoked certificate or an ability to interfere with the OCSP responder, network-level controls that prevent interception or spoofing of OCSP traffic on the IKEv2 path - for example, requiring the OCSP responder to be reachable only over a protected channel and monitoring for responder-suppression attempts - raise the bar materially, but they are compensating measures and not a substitute for the vendor fix. Until a patched build is confirmed installed, treat certificate-revocation-based access decisions for TheGreenBow 7.5/7.6 Windows clients as unreliable and review any tunnels established on the basis of OCSP-gated credentials.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-299 – Improper Check for Certificate Revocation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today