CVE-2015-4171: strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-sha...

Security readout for executives and security teams

This flaw could let a malicious VPN server collect credentials from strongSwan clients before the client fully rejects the server. The risk is highest where users or devices connect with IKEv2 using EAP or pre-shared keys. It is a confidentiality and credential-theft issue, not proven remote code execution. Organizations using legacy strongSwan servers or clients, especially Android VPN Client versions before 1.4.6, may be exposed if IKEv2 EAP or pre-shared-key authentication is configured. Exposure is less clear for deployments not using those authentication modes. Treat as a targeted credential-protection issue for legacy VPN environments. Prioritize remediation where strongSwan clients connect outside trusted networks or use EAP/PSK authentication. Business urgency is moderate unless affected clients are still broadly deployed. Mitigation focus: Upgrade strongSwan to 5.3.2 or later where applicable.; Upgrade strongSwan VPN Client to 1.4.6 or later.; Identify IKEv2 profiles using EAP or pre-shared keys..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.