CVE-2025-11955

Description

Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.

Is your site exposed to CVE-2025-11955?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-299 CWE-299

References

Other References

https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-validation-ocsp-certificates-thegreenbow-vpn-client-windows https://www.thegreenbow.com/en/support/security-alerts/

Frequently Asked Questions

What is CVE-2025-11955? +

Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.

How do I check if I'm vulnerable to CVE-2025-11955? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-3085 8.1

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check …

CVE-2026-6899 5.6

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in …

CVE-2025-36057 5.2

IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local Authentication Framework library …

CVE-2024-56138 4.0

notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue …