CVE-2025-44649
📋 TL;DR
This vulnerability affects TRENDnet TEW-WLC100P wireless LAN controllers configured with racoon IKE daemon using aggressive mode in Phase 1. It allows attackers to intercept identity information in plaintext and perform offline dictionary attacks against pre-shared keys. Organizations using these specific devices with default configurations are affected.
💻 Affected Systems
- TRENDnet TEW-WLC100P
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of VPN/IKE security allowing unauthorized network access, credential theft, and potential lateral movement into protected networks.
Likely Case
Successful offline dictionary attack leading to VPN/IKE key compromise and unauthorized access to the wireless controller management interface.
If Mitigated
Limited impact if strong pre-shared keys are used and network segmentation prevents access to IKE services.
🎯 Exploit Status
Exploitation requires network access to IKE services (UDP port 500/4500). Tools like ike-scan and offline dictionary attack tools can be used.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check TRENDnet website for firmware updates. 2. If update available, download and apply following vendor instructions. 3. Restart device after patching.
🔧 Temporary Workarounds
Change IKE Phase 1 mode to main
linuxModify racoon configuration to use main mode instead of aggressive mode
Edit /etc/racoon/racoon.conf or equivalent
Change 'exchange_mode aggressive;' to 'exchange_mode main;'
Restart racoon service
Implement strong pre-shared keys
allUse complex, long pre-shared keys resistant to dictionary attacks
Generate strong PSK: openssl rand -base64 32
Update PSK on all IKE peers
🧯 If You Can't Patch
- Network segmentation: Isolate IKE services from untrusted networks using firewalls
- Monitoring: Implement IDS/IPS rules to detect IKE aggressive mode negotiation attempts
🔍 How to Verify
Check if Vulnerable:
Check racoon configuration file for 'exchange_mode aggressive;' or use ike-scan with aggressive mode detectionCheck Version:
Check web interface or use SNMP to query device firmware versionVerify Fix Applied:
Verify configuration file shows 'exchange_mode main;' and test with ike-scan showing main mode negotiation📡 Detection & Monitoring
Log Indicators:
- IKE aggressive mode negotiation attempts in racoon logs
- Multiple failed IKE authentication attempts
Network Indicators:
- UDP port 500/4500 traffic with aggressive mode IKE packets
- ike-scan tool usage on network
SIEM Query:
source="racoon.log" AND "aggressive mode" OR destination_port=500 AND protocol=UDP AND packet_size<1000