TRENDnet TEW-WLC100P CVE-2025-44647

Exploitation requires that the TEW-WLC100P IKE responder is reachable and that IKEv1 Aggressive Mode with PSK is in use - which it is by default here because the strongSwan config ships with i_dont_care_about_security_and_use_aggressive_mode_psk enabled. The concrete prerequisite is the attacker's ability to elicit or observe an Aggressive Mode phase-1 exchange (either by initiating IKE to the device over UDP 500/4500 or by sniffing legitimate negotiation traffic). Key limiting factors: the disclosure itself yields only a hash, so meaningful compromise additionally requires the operator's PSK to be weak enough to crack offline; deployments using strong high-entropy PSKs, IKEv2, or certificate auth, or that have firewalled the IKE port to trusted peers, are effectively protected despite the default setting.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3) indicates a network-reachable, low-complexity, unauthenticated weakness - consistent with an attacker who can reach or observe IKE negotiation. However, the assigned I:L and A:L look generous: the direct primitive is disclosure of the PSK hash (a confidentiality issue), while any integrity or availability impact only materializes AFTER an attacker successfully cracks the PSK offline, which is not guaranteed and depends entirely on PSK strength. EPSS is low at 0.36% (28th percentile) and there is no KEV entry and no confirmed public PoC, so this is not a mass-exploitation candidate; it is a configuration-hardening/defense-in-depth issue whose real severity is dominated by whether operators chose a weak, guessable pre-shared key. Note the tension: the offline attack requires the attacker to first obtain the hash (by soliciting an Aggressive Mode exchange or sniffing legitimate traffic), a limiting factor not fully reflected by AC:L. Treat as medium priority - meaningful for VPN-terminating deployments with weak PSKs, lower risk where strong random PSKs are used.

An attacker who can reach the controller's IKE service (or passively capture VPN negotiation traffic on a shared/upstream segment) initiates an IKEv1 Aggressive Mode exchange and records the responder's openly transmitted PSK hash. They then run an offline dictionary or brute-force attack (e.g., psk-crack or hashcat) against the hash; if the PSK is weak, they recover it and can authenticate as a trusted VPN peer. No public PoC is confirmed, but the technique is well-known and low-complexity per the CVSS vector.