Paper/Archive/CVE-2024-27903

CVE-2024-27903

OpenVPN OpenVPN 2 — OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitr…

EPSS 9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 95.2.952 × 2019.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

Affected

ProductAffectedFixed inSource

OpenVPN 22.6.9 and earlier–CNA

openvpn2< 2.6.102.6.10CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADP7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcommunity.openvpn.net/openvpn/wiki/CVE-2024-27903 refopenvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974 refmail-archive.com/[email protected]/msg07534.html