A flaw in the sppp_pap_input function in OpenBSD’s networking subsystem permits an attacker to bypass PAP authentication when the packet contains certain zero values for length fields. This oversight allows an unauthorized user to gain unauthenticated access to PPP connections, potentially compromising the confidentiality and integrity of data transmitted over those links.

The vulnerability exists in all OpenBSD releases prior to the commit identified by 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8. Systems running those earlier versions of OpenBSD are susceptible, while any installation containing the fixed code is not affected.

The CVSS score of 5.8 categorizes the weakness as moderate, yet the EPSS score of less than 1% suggests a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote; an adversary could send specially crafted PPP packets containing zero-length fields to trigger the bypass. Without some form of authentication, an attacker could then establish a PPP session and potentially access network services or data.