Analyst readout for executives and security teams
Plain-English summary
CVE-2005-3915 describes a legacy IKEv1 flaw in Clavister Client Web. Crafted IKE packets could crash the service and may allow arbitrary code execution, but the public record is sparse and does not identify precise affected versions.
Executive priority
Treat this as a legacy exposure review, not a confirmed active-emergency item. Prioritize if Clavister IKEv1 services remain internet-reachable or support critical remote access.
Technical view
The issue is in Clavister Client Web's IKEv1 implementation and was demonstrated with the PROTOS ISAKMP Test Suite. The CVE notes uncertainty about which related IKEv1 PROTOS CVEs apply, so root cause, version scope, and exploitability remain unclear.
Likely exposure
Exposure is likely limited to organizations still operating legacy Clavister Client Web or related Clavister IKEv1 endpoints reachable by remote network traffic. The source bundle lists no confirmed CPEs or versions.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The issue is remotely reachable over IKEv1, but public evidence here only supports crafted-packet denial of service and possible code execution.
Researcher notes
The CVE record explicitly warns that advisory detail is insufficient to map this cleanly to CVE-2005-3666, CVE-2005-3667, or CVE-2005-3668. Avoid overclaiming affected versions, exploitability, or patch status.
Mitigation direction
- Check Clavister's ISAKMP support update and any current vendor guidance.
- Inventory Clavister Client Web and IKEv1-enabled Clavister deployments.
- Restrict IKE access to trusted peers and management networks where feasible.
- Retire or replace unsupported legacy Clavister VPN components.
- Monitor IKE/ISAKMP services for abnormal crashes or malformed-packet events.
Validation and detection
- Confirm whether Clavister Client Web is present in the environment.
- Verify whether IKEv1 is enabled and remotely reachable.
- Check deployed versions against vendor advisory information.
- Review firewall exposure for UDP IKE/ISAKMP access paths.
- Use approved defensive scanning only; avoid crash testing production services.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2005-3915 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 17663CVE reference · third-party-advisory, x_refsource_SECUNIA
- http://www.clavister.com/support/support_update_ISAKMP.htmlCVE reference · x_refsource_CONFIRM
- ADV-2005-2566CVE reference · vdb-entry, x_refsource_VUPEN
- 15560CVE reference · vdb-entry, x_refsource_BID
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.