CVE-2009-4409: Iij seil/b1

Low severity, CVSS 2.6. EPSS: 1.4% chance of exploitation in the next 30 days.

The (1) CHAP and (2) MS-CHAP-V2 authentication capabilities in the PPP Access Concentrator (PPPAC) function in Internet Initiative Japan SEIL/B1 firmware 1.00 through 2.52 use the same challenge for each authentication attempt, which allows remote attackers to bypass authentication via a replay attack.

Affected products

• Iij seil/b1: version 1.00 only; version 2.01 only; version 2.10 only; version 2.20 only; version 2.30 only; version 2.40 only; …

Published 2009-12-23. Last modified 2026-06-16.