EUVD-2026-59607
GHSA-5823-mg62-gvvv
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but AC:H for required traffic interception; no privileges or interaction needed; only partial credential material exposed, no integrity or availability impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange_mode causes missing encryption of sensitive data. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The vendor was contacted early about this disclosure.
AnalysisAI
Missing encryption of sensitive data in TRENDnet TEW-WLC100 (firmware 2.05b02) exposes VPN negotiation material when the racoon IKE daemon is configured to use IKE Phase 1 Aggressive Mode. An unauthenticated remote attacker positioned on the network path can passively intercept Aggressive Mode handshake traffic, capturing identity information and pre-shared key (PSK) hashes in cleartext, which are then subject to offline cracking. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 4.0 rates this at 6.3 (Medium) with AC:H, reflecting the elevated complexity needed to intercept IKE traffic.
Technical ContextAI
The affected file is /etc/racoon.conf on TRENDnet TEW-WLC100 firmware 2.05b02 - the configuration file for the racoon IKE daemon, which handles IPsec key exchange. IKE Phase 1 defines how two peers negotiate a secure channel; Aggressive Mode compresses this handshake into three messages (versus six in Main Mode), transmitting identity payloads and PSK hashes before an encrypted channel is established. This design omission means that any party with visibility into the UDP/500 traffic stream can observe identity strings and capture the PSK hash for offline dictionary or brute-force attack. CWE-310 (Cryptographic Issues) correctly classifies the root cause: the protocol step responsible for protecting credential material is bypassed by the choice of exchange_mode. The TEW-WLC100 is a wireless LAN controller, meaning successful PSK recovery could undermine the VPN fabric used to manage access points.
RemediationAI
The primary remediation is to disable IKE Phase 1 Aggressive Mode by changing exchange_mode to main in /etc/racoon.conf, which enforces Main Mode negotiation and keeps identity and key material protected within the encrypted channel. Administrators should then restart the racoon daemon to apply the change. If Main Mode is not operationally viable (e.g., dynamic IP peers require Aggressive Mode for identity discrimination), a compensating control is to restrict IKE traffic (UDP port 500 and 4500) to known peer IP addresses via ACL or firewall rule, reducing passive interception risk - though this does not eliminate the protocol-level weakness. Additionally, use a high-entropy pre-shared key (20+ random characters) to resist offline cracking even if the PSK hash is captured. Check https://vuldb.com/vuln/390080 and TRENDnet's official advisory channel for firmware updates that may enforce Main Mode or migrate to IKEv2, which does not have this Aggressive Mode issue. No vendor-released patched firmware version was identified in the available data.
Same weakness CWE-310 – Cryptographic Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today