TRENDnet TEW-WLC100 CVE-2026-19891

IKE Phase 1 Aggressive Mode must be explicitly configured as the exchange_mode value in /etc/racoon.conf on the TEW-WLC100. This is a non-default-versus-default question that depends on how the administrator provisioned the VPN - if Main Mode is configured, this vulnerability does not apply. The attacker must be positioned on the network path to observe or capture UDP/500 (IKE) traffic between the TEW-WLC100 and a VPN peer; passive interception is sufficient (no active injection required, though MitM positioning raises complexity). CVSS AC:H confirms the complexity of achieving this network position. No credentials are required (PR:N) and no user interaction is needed (UI:N). Exploitation is limited to confidentiality of PSK/identity material only - no code execution or service disruption is possible through this vector. Success also depends on PSK entropy: strong random PSKs substantially resist offline cracking even if the hash is captured.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) assigns a 6.3 Medium score. AC:H is the primary depressor: the attacker must achieve a network-path position sufficient to capture IKE UDP/500 traffic, which requires either a MitM position on the WAN segment or passive access to a mirrored/tapped link. The VC:L rating reflects that only partial credential material (PSK hash, identity) is exposed rather than a full session compromise. No EPSS data was available in the provided intelligence. There is no KEV listing and no confirmed public POC, making opportunistic mass exploitation unlikely. The realistic threat is a targeted attacker on the same ISP segment or with access to upstream routing - not a script-kiddie scenario. Confidentiality impact is bounded: an attacker still needs to crack the PSK offline, which depends on its entropy. The lack of integrity or availability impact further limits blast radius. Overall: genuine risk to organizations relying on this device's IPsec VPN, but not a broadly exploitable internet-facing flaw given AC:H.

An attacker with passive visibility into the WAN interface of the TEW-WLC100 - achieved through ISP-level access, a compromised upstream router, or physical tap - captures IKE UDP/500 traffic during a VPN peer negotiation. The Aggressive Mode handshake transmits the peer identity and PSK hash in cleartext, which the attacker records and submits to an offline dictionary attack tool such as hashcat or john. If the pre-shared key has low entropy, it is recovered within hours and can be used to authenticate as a legitimate VPN peer or decrypt previously recorded IPsec sessions. No public POC is known, but the technique is well-documented in IPsec security literature.