CVE-2015-8023: The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 thro...

Security readout for executives and security teams

CVE-2015-8023 lets a remote attacker bypass authentication against affected strongSwan VPN servers using the EAP-MSCHAPv2 plugin. In business terms, a vulnerable VPN authentication path could admit an unauthorized user. The sources do not provide CVSS data here, and CISA KEV status is false. Exposure is likely limited to strongSwan deployments acting as an EAP-MSCHAPv2 server with affected versions before 5.3.4. Systems not using the eap-mschapv2 plugin or not terminating this authentication method are less likely exposed. Prioritize remediation for exposed VPN infrastructure. Even without confirmed active exploitation in the provided sources, authentication bypass on remote access services can create direct unauthorized network entry. Mitigation focus: Upgrade strongSwan to 5.3.4 or a vendor-fixed package.; Prioritize VPN gateways using the eap-mschapv2 plugin.; If upgrade is delayed, check vendor advisories for supported interim guidance..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.