CVE-2023-32634

An authentication bypass vulnerability exists in the CiRpcServerThread functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability...

CVE-2023-31192

The CVE-2023-31192 entry concerns SoftEther VPN 5.01.9674. The vulnerability resides in the ClientConnect() function and is an information-disclosure issue triggered by specially crafted network packets, potentially enabling a man-in-the-middle to exfiltrate sensitive data. Affected component/fil...

CVE-2023-31192

An information disclosure vulnerability exists in the ClientConnect functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2023-31192

An information disclosure vulnerability exists in the ClientConnect functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2023-32634

CVE-2023-32634 affects SoftEther VPN (CiRpcServerThread) and enables an authentication bypass that can be exploited by a local attacker to mount a man-in-the-middle and access/modify communications. Public listings consistently name SoftEther VPN versions 5.01.9674 and 4.41-9782-beta as affected,...

PT-2023-23218

Name of the Vulnerable Software and Affected Versions SoftEther VPN version 5.01.9674 Description An information disclosure issue exists in the ClientConnect functionality. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a...

SoftEther VPN vpnserver WpcParsePacket() heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1735 SoftEther VPN vpnserver WpcParsePacket heap-based buffer overflow vulnerability October 12, 2023 CVE Number CVE-2023-27395 SUMMARY A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket functionality of SoftEther VPN...

SoftEther VPN vpnserver ConnectionAccept() denial-of-service vulnerability

Talos Vulnerability Report TALOS-2023-1743 SoftEther VPN vpnserver ConnectionAccept denial-of-service vulnerability October 12, 2023 CVE Number CVE-2023-25774 SUMMARY A denial-of-service vulnerability exists in the vpnserver ConnectionAccept functionality of SoftEther VPN 5.02. A set of specially...

SoftEther VPN vpnserver EnSafeHttpHeaderValueStr denial of service vulnerability

Talos Vulnerability Report TALOS-2023-1741 SoftEther VPN vpnserver EnSafeHttpHeaderValueStr denial of service vulnerability October 12, 2023 CVE Number CVE-2023-23581 SUMMARY A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.967...

SoftEther VPN CiRpcServerThread() MitM authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1755 SoftEther VPN CiRpcServerThread MitM authentication bypass vulnerability October 12, 2023 CVE Number CVE-2023-32634 SUMMARY An authentication bypass vulnerability exists in the CiRpcServerThread functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta...

SoftEther VPN DCRegister DDNS_RPC_MAX_RECV_SIZE denial of service vulnerability

Talos Vulnerability Report TALOS-2023-1736 SoftEther VPN DCRegister DDNSRPCMAXRECVSIZE denial of service vulnerability October 12, 2023 CVE Number CVE-2023-22325 SUMMARY A denial of service vulnerability exists in the DCRegister DDNSRPCMAXRECVSIZE functionality of SoftEther VPN 4.41-9782-beta,...

SoftEther VPN ClientConnect() information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1768 SoftEther VPN ClientConnect information disclosure vulnerability October 12, 2023 CVE Number CVE-2023-31192 SUMMARY An information disclosure vulnerability exists in the ClientConnect functionality of SoftEther VPN 5.01.9674. A specially crafted network...

SoftEther VPN vpnserver OvsProcessData denial of service vulnerability

Talos Vulnerability Report TALOS-2023-1737 SoftEther VPN vpnserver OvsProcessData denial of service vulnerability October 12, 2023 CVE Number CVE-2023-22308 SUMMARY An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A...

SoftEther VPN CiRpcAccepted() authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1754 SoftEther VPN CiRpcAccepted authentication bypass vulnerability October 12, 2023 CVE Number CVE-2023-27516 SUMMARY An authentication bypass vulnerability exists in the CiRpcAccepted functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially...

PT-2023-23695 · Unknown · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEther VPN versions 4.41-9782-beta through 5.01.9674 Description: An information disclosure issue exists in the CtEnumCa functionality. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can se...

SoftEther VPN Security Vulnerability

SoftEther VPN is an open source, cross-platform, multi-protocol VPN Virtual Private Network application. A security vulnerability exists in SoftEther VPN versions 5.01.9674 and 5.02, which stems from a denial-of-service vulnerability in the DCRegister DDNSRPCMAXRECVSIZE function, which can be...

Fortinet Fortigate Plain-text credentials in GET request via SSL VPN web portal (FG-IR-23-120)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-120 advisory. - A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 an...

PT-2023-20294

Name of the Vulnerable Software and Affected Versions SoftEther VPN version 5.02 Description A denial-of-service issue exists in the ConnectionAccept functionality of the vpnserver. It can be triggered by a set of specially crafted network connections, allowing an attacker to send malicious packe...

SoftEther VPN Information Disclosure Vulnerability

SoftEther VPN is an open source cross-platform multi-protocol VPN Virtual Private Network application. An information disclosure vulnerability exists in SoftEther VPN version 5.01.9674, which originates from an information disclosure vulnerability in the ClientConnect function, which can be...

CVE-2023-22325: Loop with Unreachable Exit Condition

A denial of service vulnerability exists in the DCRegister DDNSRPCMAXRECVSIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...