CVE-2023-26463

Deeper analysis

strongSwan versions 5.9.8 and 5.9.9 contain a use-after-free vulnerability stemming from reuse of a variable named "public" for two distinct purposes inside the same function. The flaw manifests as an initial access-control bypass followed by an expired pointer dereference and is reachable only when the daemon loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). The affected component is therefore any strongSwan server configured for these EAP methods.

An unauthenticated remote attacker can trigger the flaw by presenting a crafted client certificate during an EAP-TLS exchange. Successful exploitation yields remote code execution with the privileges of the charon process, enabling full compromise of the VPN gateway. The CVSS 3.1 base score of 9.8 reflects the absence of required authentication or user interaction and the complete confidentiality, integrity, and availability impact.

The issue is resolved in strongSwan 5.9.10; administrators are advised to upgrade immediately. Vendor advisories from strongSwan and NetApp reiterate that only servers exposing the listed EAP plugins are affected and that the fix eliminates the double use of the variable.

EPSS for the CVE rose from a low baseline to a peak of 0.1284 (currently 0.1154), indicating measurable post-disclosure exploitation interest that warrants renewed attention.