← back
CVE-2025-11955

Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise

CVSS 8.2 HIGHEPSS 0.3%CWE-299
Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
TheGreenBow · TheGreenBow VPN Client Windows Enterprise

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-validation-ocsp-certificates-thegreenbow-vpn-client-windowshttps://www.thegreenbow.com/en/support/security-alerts/