CVE-2018-16738

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial...

3.7 LowFix available

CVE-2018-16738 is a low vulnerability (CVSS 3.7) in Tinc-vpn Tinc, published October 8, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in tinc 1.0.35-r0.

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.35%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 3.7

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Record: CVE-2018-16738
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Record: CVE-2018-16738
Updated: 2026-11-02

EUVDEUVD-2018-8538 No score

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Record: EUVD-2018-8538
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c478-67p7-rg2p 3.7

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial...

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Record: GHSA-c478-67p7-rg2p
CVSS 3.0: 3.7 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVALPINE-CVE-2018-16738 3.7

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Record: ALPINE-CVE-2018-16738
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSV 3.7

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Record: CVE-2018-16738
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-16738 3.7

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Record: DEBIAN-CVE-2018-16738
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-16738 3.7

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.

Record: UBUNTU-CVE-2018-16738
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`tinc` Alpine:v3.10	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.11	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.12	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.13	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.14	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.15	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.16	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.17	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.18	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.19	1.0.30 up to 1.0.35-r0	1.0.35-r0

Show 15 moreShow less

Affected packages
Package	Affected	Fixed
`tinc` Alpine:v3.20	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.21	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.22	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.23	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.24	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.6	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.7	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.8	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Alpine:v3.9	1.0.30 up to 1.0.35-r0	1.0.35-r0
`tinc` Debian:12	before 1.0.35-1	1.0.35-1
`tinc` Debian:13	before 1.0.35-1	1.0.35-1
`tinc` Debian:14	before 1.0.35-1	1.0.35-1
`tinc` Debian:9	before 1.0.31-1+deb9u1, plus listed versions 1.0.31-1	1.0.31-1+deb9u1
`tinc` Ubuntu:16.04:LTS	All versions, plus listed versions 1.0.26-1	None known
`tinc` Ubuntu:18.04:LTS	All versions, plus listed versions 1.0.31-11.0.32-11.0.33-11.0.33-1build1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less