CVE-2008-1618: WatchGuard Firebox Pptp VPN

Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days.

The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames.

Affected products

• WatchGuard Firebox Pptp VPN: version 4.9 only; version 5.0 only

Published 2008-04-07. Last modified 2026-06-16.