CVE-2024-27903

2024-07-0811:15:10

CWE-283

CWE-434

OpenVPN

web.nvd.nist.gov

openvpn

windows

arbitrary loading

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

30.2%

JSON

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

Affected configurations

Nvd

Node

openvpnopenvpnRange<2.5.10community

openvpnopenvpnRange2.6.0–2.6.10community

VendorProductVersionCPE
openvpnopenvpn*cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*

Vendor	Product	Version	CPE
openvpn	openvpn	*	cpe:2.3:a:openvpn:openvpn:::::community:::*

CNA Affected

[
  {
    "vendor": "OpenVPN",
    "product": "OpenVPN 2",
    "platforms": [
      "Windows"
    ],
    "modules": [
      "Core"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "2.6.9 and earlier"
      }
    ],
    "defaultStatus": "unaffected"
  }
]