CVE-2024-45750 Overview
CVE-2024-45750 affects multiple TheGreenBow VPN Client products across Windows, Android, Linux, and macOS platforms. The flaw resides in the Internet Key Exchange version 2 (IKEv2) authentication phase. The client accepts malformed Elliptic Curve Digital Signature Algorithm (ECDSA) signatures and establishes a VPN tunnel regardless. A remote attacker can leverage this authentication weakness to impersonate a legitimate VPN gateway and execute arbitrary code in the client context. The vulnerability is tracked under [CWE-287] Improper Authentication.
Critical Impact
Remote attackers can bypass IKEv2 ECDSA signature validation to establish unauthorized VPN tunnels and execute arbitrary code on connected clients.
Affected Products
- TheGreenBow Windows Standard VPN Client 6.87.108 and earlier
- TheGreenBow Windows Enterprise VPN Client 6.87.109 and 7.5.007 and earlier
- TheGreenBow Android, Linux 3.4, and macOS 2.4.10 VPN Clients and earlier
Discovery Timeline
- 2024-09-25 - CVE-2024-45750 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-45750
Vulnerability Analysis
The vulnerability stems from improper ECDSA signature validation during the IKEv2 authentication exchange. IKEv2 uses digital signatures to mutually authenticate the VPN gateway and client before establishing a Security Association. TheGreenBow VPN clients fail to correctly verify the integrity of ECDSA signatures presented by the remote peer. Malformed signatures that should be rejected are instead accepted as valid. This allows the tunnel to be established with an attacker who does not possess the legitimate private key.
With an EPSS score of 8.656% (92.586 percentile), this issue ranks well above the median for likelihood of exploitation activity within 30 days.
Root Cause
The root cause is improper authentication logic in the IKEv2 implementation. The signature verification routine does not enforce strict conformance to ECDSA encoding rules. Malformed or attacker-crafted signatures that fail to satisfy mathematical validity checks are treated as valid, breaking the trust foundation of mutual authentication.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker positioned to respond to IKEv2 connection attempts, through DNS hijacking, BGP redirection, or rogue gateway impersonation, can present a malformed ECDSA signature during the AUTH exchange. The client accepts the signature, completes the key exchange, and establishes a tunnel with the attacker-controlled endpoint. Once the tunnel is up, the attacker can deliver payloads or route malicious traffic into the client. See the TheGreenBow Security Alert #17024 for vendor details.
Detection Methods for CVE-2024-45750
Indicators of Compromise
- VPN tunnel establishment to IP addresses or gateway identities not present in approved corporate VPN configurations.
- IKEv2 negotiation logs showing successful AUTH completion with ECDSA peers whose certificates fail external validation.
- Unexpected DNS resolutions for the VPN gateway hostname preceding tunnel establishment.
Detection Strategies
- Inspect IKEv2 traffic on UDP ports 500 and 4500 for AUTH payloads originating from unauthorized peer addresses.
- Correlate VPN client connection events with endpoint process telemetry to identify post-tunnel code execution.
- Audit installed TheGreenBow VPN client versions across the fleet and flag instances at or below the vulnerable releases.
Monitoring Recommendations
- Enable verbose IKEv2 logging on VPN clients and forward logs to a centralized SIEM for signature validation anomalies.
- Monitor egress network flows for VPN sessions terminating at unexpected geolocations or autonomous systems.
- Alert on creation of new VPN profiles or modifications to existing profile certificates and gateway addresses.
How to Mitigate CVE-2024-45750
Immediate Actions Required
- Upgrade all TheGreenBow VPN clients to the fixed versions listed in TheGreenBow Security Alert #17024.
- Inventory endpoints running affected Windows, Android, Linux, and macOS VPN client builds and prioritize remote and travelling users.
- Rotate any credentials or certificates used by clients that may have connected through untrusted networks since deployment.
Patch Information
TheGreenBow has released updated VPN client versions addressing the ECDSA signature validation flaw. Refer to TheGreenBow Security Alert #17024 for the specific fixed builds for Windows Standard, Windows Enterprise, Android, Linux, and macOS clients. Apply patches through the standard enterprise software distribution workflow.
Workarounds
- Restrict VPN client usage on untrusted networks until patches are deployed across all affected platforms.
- Enforce certificate pinning or pre-shared key authentication where supported to reduce reliance on ECDSA signature validation.
- Use network segmentation and host firewall policies to limit the impact of a tunnel established with a rogue gateway.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
