TRENDnet TEW-WLC100P CVE-2025-44649

The device must be running firmware 2.03b03 with racoon configured such that exchange_mode lists aggressive as the first (selected) option - this is the shipped default configuration, so no non-default change is needed on the target. To gain value, the attacker must be able to either passively observe an IKE Phase 1 negotiation (requiring a man-in-the-middle or on-path network position) or actively initiate a Phase 1 handshake against the device's IKE endpoint (UDP 500/4500 reachable). Successful PSK recovery is further limited by PSK strength: a long, random pre-shared key makes the offline dictionary attack computationally infeasible, so the practical impact hinges on a weak/guessable PSK. Identity disclosure itself occurs whenever aggressive mode is negotiated, with no authentication required.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) rates this High and network-exploitable with confidentiality-only impact, which aligns with the information-disclosure nature of aggressive mode. However, that AV:N/AC:L/PR:N framing likely overstates ease: realistic exploitation requires the attacker to either passively intercept an IKE negotiation (privileged network position) or actively initiate a Phase 1 handshake with the device, and the damaging outcome - PSK recovery - is contingent on the PSK being weak enough to crack offline. Corroborating low-urgency signals: EPSS is 0.27% (19th percentile), the CVE is not in CISA KEV, and no SSVC decision data or verified POC is provided. The two references are researcher writeups (a GitHub gist and a Notion page), not a vendor advisory, so patch and formal exploit status are unconfirmed. Net: a legitimate hardening defect worth fixing on affected appliances, but not an emergency - treat as medium-priority absent evidence of a weak PSK or active targeting. Note the tension to verify: CVSS implies trivial network compromise, while the underlying weakness practically depends on an observed/initiated negotiation and a guessable PSK.

An attacker positioned to intercept traffic to the TEW-WLC100P, or able to reach its IKE service, initiates or captures an IKE Phase 1 aggressive-mode exchange and records the plaintext identity payload plus the responder's PSK-derived hash. They then run an offline dictionary/brute-force attack against the hash; if the pre-shared key is weak, they recover it and can impersonate a VPN peer or decrypt subsequent IPsec traffic. No POC is confirmed in the provided data, though the low attack complexity (AC:L) means capturing the exposed data is straightforward once a negotiation is observed.