Security readout for executives and security teams
Plain-English summary
This CVE describes an insecure default IPsec/IKE setting in the TRENDnet TEW-WLC100P 2.03b03 racoon configuration. Aggressive mode can expose identity information and make password guessing attacks easier. The business concern is confidentiality loss for environments using this controller’s VPN/IPsec configuration.
Executive priority
Prioritize review for any internet-facing or partner-facing controller using IPsec. Treat as high urgency where VPN identity confidentiality or shared-secret strength matters. If the product is not deployed, no direct action is indicated.
Technical view
The reported issue is that the first racoon exchange_mode value is set to aggressive. In IKE Phase 1, aggressive mode exposes identity data in plaintext, supports offline dictionary attack conditions, and weakens negotiation flexibility. CVSS is 7.5 with network access and no authentication required.
Likely exposure
Exposure appears limited to deployments of TRENDnet TEW-WLC100P version 2.03b03 using the affected racoon/IPsec configuration. The CVE affected-product metadata is incomplete and lists vendor, product, and CPE as n/a, so asset validation is necessary.
Exploitation context
The source bundle does not report active exploitation, and KEV is false. The risk is credible because aggressive mode is a known weak IKE Phase 1 configuration, but the provided sources do not prove public exploitation against this device.
Researcher notes
The record is sparse: affected CPE fields are n/a, and only the description names TRENDnet TEW-WLC100P 2.03b03. Analysis should stay tied to racoon IKE aggressive mode behavior and avoid assuming broader TRENDnet exposure or confirmed remediation.
Mitigation direction
- Check TRENDnet guidance for patched firmware or configuration recommendations.
- Disable IKE aggressive mode where supported by the product.
- Prefer main mode or stronger vendor-supported IPsec settings.
- Restrict IPsec/IKE exposure to trusted networks where operationally possible.
- Rotate weak pre-shared keys if aggressive mode was enabled.
Validation and detection
- Inventory TRENDnet TEW-WLC100P devices and confirm firmware version 2.03b03.
- Review racoon configuration for exchange_mode using aggressive as the first value.
- Confirm whether IPsec/IKE services are reachable from untrusted networks.
- Check VPN logs for unusual or repeated IKE negotiation attempts.
- Track vendor advisories because affected metadata and fixes are incomplete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-312: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-44649 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://gist.github.com/TPCchecker/6d787c4916891f493b274b70abfad860CVE reference, mitre
- https://www.notion.so/CVE-2025-44649-24754a1113e780a4a1d1c4cd6d3ff345CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.