CVE-2008-1618
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2...
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames.
Exploit likelihood
What each source reports
NVD Score used
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames.
- Record
CVE-2008-1618- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames.
- Record
CVE-2008-1618- Updated
- 2026-11-02
EUVDEUVD-2008-1619 No score
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames.
- Record
EUVD-2008-1619- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pv8j-6vmm-x69g No score
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2...
The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames.
- Record
GHSA-pv8j-6vmm-x69g- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1618 is a medium vulnerability (CVSS 5.0) in Watchguard Firebox Pptp Vpn, published April 7, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. No source names a fixed version.
References
mwrinfosecurity.com/publications/mwri_watchguard-firebox-pptp-vpn-user-enumeration-advisory_2008-04-04.pdf
osvdb.org/44218
vupen.com/english/advisories/2008/1152/references
securityfocus.com/bid/28619
exchange.xforce.ibmcloud.com/vulnerabilities/41683
secunia.com/advisories/29708
securitytracker.com/id?1019796
nvd.nist.gov/vuln/detail/CVE-2008-1618
github.com/advisories/GHSA-pv8j-6vmm-x69g