CVE-2024-27903

2024-07-0810:27:40

CWE-283

OpenVPN

www.cve.org

openvpn

windows

vulnerability

plug-in loading

arbitrary

interactive service

EPSS

0.001

Percentile

30.2%

JSON

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

CNA Affected

[
  {
    "vendor": "OpenVPN",
    "product": "OpenVPN 2",
    "platforms": [
      "Windows"
    ],
    "modules": [
      "Core"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "2.6.9 and earlier"
      }
    ],
    "defaultStatus": "unaffected"
  }
]