CVE-2015-3966

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

The IPsec SA establishment process on Innominate mGuard devices with firmware 8.x before 8.1.7 allows remote authenticated users to cause a denial of service (VPN service restart) by leveraging a peer relationship to send a crafted configuration with compression.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:N/I:N/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.innominate.com/data/downloads/software/innominate_security_advisory_20150714_001_en.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-239-03Third Party Advisory, US Government Resource
http://www.innominate.com/data/downloads/software/innominate_security_advisory_20150714_001_en.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-239-03Third Party Advisory, US Government Resource

Timeline

Published: Aug 30, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-39676.8Cross-site request forgery (CSRF) vulnerability on Janitza UMG 508, 509, 511, 604, and 605 devices allows remote attackers to hijack the aut CVE-2015-39687.5The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to rea CVE-2015-39695.0Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to U CVE-2015-39704.3Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote att CVE-2015-39717.5The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to rea CVE-2015-397210.0The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easie CVE-2015-39735.0Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine CVE-2015-39749.0EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/Easy CVE-2015-39765.4Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2 CVE-2015-39777.7Buffer overflow in Schneider Electric IMT25 Magnetic Flow DTM before 1.500.004 for the HART Protocol allows remote authenticated users to ex CVE-2015-39782.1SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note CVE-2015-39797.5Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vec