CVE-2025-11955: TheGreenBow VPN Auth Bypass Vulnerability

CVE-2025-11955 Overview

CVE-2025-11955 is an improper certificate validation vulnerability [CWE-299] affecting TheGreenBow VPN client versions 7.5 and 7.6. The flaw resides in the Online Certificate Status Protocol (OCSP) verification logic invoked during Internet Key Exchange version 2 (IKEv2) authentication. The OCSP-enabled client establishes the VPN tunnel even when it receives no OCSP response, or when the OCSP response carries an invalid signature. Attackers positioned to manipulate certificate revocation responses can therefore authenticate sessions using revoked or forged certificates.

Critical Impact
The VPN client accepts missing or unsigned OCSP responses during IKEv2 authentication, allowing revoked certificates to establish trusted tunnels and undermining the confidentiality guarantees of the VPN.

Affected Products

TheGreenBow VPN Client for Windows version 7.5
TheGreenBow VPN Client for Windows version 7.6
Deployments configured with OCSP-based certificate revocation checking

Discovery Timeline

2025-10-27 - CVE-2025-11955 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11955

Vulnerability Analysis

The vulnerability stems from incomplete enforcement of OCSP response validation during the IKEv2 authentication exchange. OCSP allows a client to query a responder for the real-time revocation status of an X.509 certificate. A correctly implemented client must treat absent responses and responses with invalid signatures as authentication failures. The TheGreenBow VPN client instead proceeds to establish the tunnel under these conditions.

This behavior defeats the purpose of revocation checking. An attacker holding a previously revoked certificate, or operating in a network position that can suppress OCSP traffic, can authenticate to the VPN gateway. The client trusts the resulting tunnel, exposing protected resources to an unauthorized peer.

The vulnerability is categorized as Improper Check for Certificate Revocation [CWE-299]. The EPSS score is 0.032%, reflecting that no public exploit has been observed at the time of publication.

Root Cause

The IKEv2 authentication routine in versions 7.5 and 7.6 fails to apply a fail-closed policy to OCSP verification. When the OCSP responder is unreachable, the client should abort the handshake. When the OCSP response signature does not validate against the trusted responder key, the client should reject the certificate. Neither check enforces tunnel termination in the affected versions.

Attack Vector

Exploitation requires a network-adjacent attacker capable of intercepting or suppressing OCSP traffic between the client and the responder, or possession of a revoked but otherwise valid client certificate. The attacker either drops outbound OCSP requests, forcing a no-response condition, or returns a forged OCSP reply with an arbitrary signature. In both cases the client accepts the certificate and completes the IKEv2 handshake.

No verified public proof-of-concept code has been published. The vulnerability mechanism is described in the INCIBE Notice on OCSP Certificate Validation and the TheGreenBow Security Alert.

Detection Methods for CVE-2025-11955

Indicators of Compromise

Successful IKEv2 tunnel establishment from endpoints running TheGreenBow VPN 7.5 or 7.6 where no corresponding OCSP request egresses the network
VPN gateway authentication events using certificates that appear on a Certificate Revocation List (CRL)
OCSP responder logs missing queries from clients that completed successful VPN sessions

Detection Strategies

Correlate VPN connection logs from the IKEv2 gateway with OCSP responder query logs to identify sessions that authenticated without a corresponding revocation check
Inventory endpoints to identify installations of TheGreenBow VPN Client versions 7.5 and 7.6
Inspect network traffic for IKEv2 sessions that complete without prior OCSP traffic to the configured responder URL

Monitoring Recommendations

Enable verbose IKEv2 and certificate validation logging on the VPN gateway to capture certificate serial numbers used in each authentication
Forward VPN authentication telemetry and endpoint software inventory into a centralized SIEM for cross-referencing against the affected version list
Alert on certificate authentications that bypass OCSP response validation or use serial numbers present on internal CRLs

How to Mitigate CVE-2025-11955

Immediate Actions Required

Identify all endpoints running TheGreenBow VPN client versions 7.5 and 7.6 and prioritize them for remediation
Apply the vendor-supplied fixed release referenced in the TheGreenBow Security Alert
Rotate and re-issue client certificates if there is suspicion that revoked credentials were used to establish unauthorized tunnels
Review VPN gateway logs for the past 90 days to detect authentications from certificates currently on a CRL

Patch Information

TheGreenBow has published guidance through its security alerts portal. Administrators should consult the TheGreenBow Security Alerts page and the INCIBE advisory for the specific fixed version and upgrade procedure. Upgrade all instances of versions 7.5 and 7.6 to the corrected release.

Workarounds

Enforce certificate revocation checking at the VPN gateway rather than relying solely on the client, so revoked certificates are rejected server-side
Where feasible, switch from OCSP to CRL-based revocation checking with strict fail-closed semantics until clients are patched
Restrict outbound network paths so that OCSP responder traffic cannot be silently dropped between client and responder

bash

# Example: enforce strict OCSP checking on a strongSwan-based IKEv2 gateway
# /etc/strongswan.conf
charon {
  plugins {
    revocation {
      enable_ocsp = yes
      enable_crl  = yes
      # Reject authentication if revocation status cannot be determined
      timeout = 10
    }
  }
  # Treat unknown or unreachable revocation status as a hard failure
  cert_cache = no
}