Unscored severity · published Apr 7, 2008
CVE-2008-1618
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is…
–
CVSS
1.7%
EPSS
No
On KEV
Description
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FP
Firebox Pptp Vpn · Watchguard
4.9; 5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1618
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1618
Vendor Advisory
http://secunia.com/advisories/29708
Exploit
http://www.mwrinfosecurity.com/publications/mwri_watchguard-firebox-pptp-vpn-user-enumeration-advisory_2008-04-04.pdf
www.osvdb.org
http://www.osvdb.org/44218
www.securityfocus.com
http://www.securityfocus.com/bid/28619
www.securitytracker.com
http://www.securitytracker.com/id?1019796
Vendor Advisory
http://www.vupen.com/english/advisories/2008/1152/references