SoftEther VPN Security Vulnerability

SoftEther VPN is an open source, cross-platform, multi-protocol VPN Virtual Private Network application. A security vulnerability exists in SoftEther VPN versions 4.41-9782-beta and 5.01.9674, which stems from an authentication bypass vulnerability in the CiRpcAccepted function, which can be...

SoftEther VPN Buffer Error Vulnerability

SoftEther VPN is an open source, cross-platform, multi-protocol VPN Virtual Private Network application. A security vulnerability exists in SoftEther VPN versions 4.41-9782-beta, 5.01.9674, and 5.02, which stems from a denial-of-service vulnerability in the WpcParsePacket function, which can be...

SoftEther VPN Security Vulnerability

SoftEther VPN is an open source, cross-platform, multi-protocol VPN Virtual Private Network application. A security vulnerability exists in SoftEther VPN version 5.01.9674 and 4.41-9782-beta, which stems from an authentication bypass vulnerability in the CiRpcServerThread function. An attacker ca...

CVE-2023-22308: Integer Underflow (Wrap or Wraparound)

An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability...

PT-2023-18416

Name of the Vulnerable Software and Affected Versions SoftEther VPN versions 5.01.9674 through 5.02 Description An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality. A specially crafted network packet can lead to denial of service. An attacker can send a malicio...

PT-2023-20294

Name of the Vulnerable Software and Affected Versions SoftEther VPN version 5.02 Description A denial-of-service issue exists in the ConnectionAccept functionality of the vpnserver. It can be triggered by a set of specially crafted network connections, allowing an attacker to send malicious packe...

SoftEther VPN vpnserver EnSafeHttpHeaderValueStr denial of service vulnerability

Talos Vulnerability Report TALOS-2023-1741 SoftEther VPN vpnserver EnSafeHttpHeaderValueStr denial of service vulnerability October 12, 2023 CVE Number CVE-2023-23581 SUMMARY A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.967...

SoftEther VPN vpnserver OvsProcessData denial of service vulnerability

Talos Vulnerability Report TALOS-2023-1737 SoftEther VPN vpnserver OvsProcessData denial of service vulnerability October 12, 2023 CVE Number CVE-2023-22308 SUMMARY An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A...

SoftEther VPN ClientConnect() information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1768 SoftEther VPN ClientConnect information disclosure vulnerability October 12, 2023 CVE Number CVE-2023-31192 SUMMARY An information disclosure vulnerability exists in the ClientConnect functionality of SoftEther VPN 5.01.9674. A specially crafted network...

SoftEther VPN CtEnumCa() information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1753 SoftEther VPN CtEnumCa information disclosure vulnerability October 12, 2023 CVE Number CVE-2023-32275 SUMMARY An information disclosure vulnerability exists in the CtEnumCa functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted...

SoftEther VPN DCRegister DDNS_RPC_MAX_RECV_SIZE denial of service vulnerability

Talos Vulnerability Report TALOS-2023-1736 SoftEther VPN DCRegister DDNSRPCMAXRECVSIZE denial of service vulnerability October 12, 2023 CVE Number CVE-2023-22325 SUMMARY A denial of service vulnerability exists in the DCRegister DDNSRPCMAXRECVSIZE functionality of SoftEther VPN 4.41-9782-beta,...

SoftEther VPN vpnserver WpcParsePacket() heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1735 SoftEther VPN vpnserver WpcParsePacket heap-based buffer overflow vulnerability October 12, 2023 CVE Number CVE-2023-27395 SUMMARY A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket functionality of SoftEther VPN...

SoftEther VPN vpnserver ConnectionAccept() denial-of-service vulnerability

Talos Vulnerability Report TALOS-2023-1743 SoftEther VPN vpnserver ConnectionAccept denial-of-service vulnerability October 12, 2023 CVE Number CVE-2023-25774 SUMMARY A denial-of-service vulnerability exists in the vpnserver ConnectionAccept functionality of SoftEther VPN 5.02. A set of specially...

SoftEther VPN CiRpcServerThread() MitM authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1755 SoftEther VPN CiRpcServerThread MitM authentication bypass vulnerability October 12, 2023 CVE Number CVE-2023-32634 SUMMARY An authentication bypass vulnerability exists in the CiRpcServerThread functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta...

SoftEther VPN CiRpcAccepted() authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1754 SoftEther VPN CiRpcAccepted authentication bypass vulnerability October 12, 2023 CVE Number CVE-2023-27516 SUMMARY An authentication bypass vulnerability exists in the CiRpcAccepted functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially...

Guyana Governmental Entity Hit by DinodasRAT in Cyber Espionage Attack

A governmental entity in Guyana has been targeted as part of a cyber espionage campaign dubbed Operation Jacana. The activity, which was detected by ESET in February 2023, entailed a spear-phishing attack that led to the deployment of a hitherto undocumented implant written in C++ called...

The vulnerability of the Dynamic DNS (DDNS) function of the SoftEther VPN client allows a hacker to execute arbitrary code.

The vulnerability of the Dynamic DNS DDNS function in the SoftEther VPN client client involves the possibility of buffer overflow attacks. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by performing a “man-in-the-middle” attack...

Flax Typhoon using legitimate software to quietly access Taiwanese organizations

Summary Microsoft has identified a nation-state activity group tracked as Flax Typhoon, based in China, that is targeting dozens of organizations in Taiwan with the likely intention of performing espionage. Flax Typhoon gains and maintains long-term access to Taiwanese organizations networks with...

Multiple vulnerabilities in SoftEther VPN and PacketiX VPN

Overview SoftEther VPN provided by University of Tsukuba SoftEther VPN Project and PacketiX VPN provided by SoftEther Corporation contain multiple vulnerabilities listed below in VPN Client function, and Dynamic DNS Client function included in the VPN server. Heap-based buffer overflow CWE-122 -...

JVN#64316789: Multiple vulnerabilities in SoftEther VPN and PacketiX VPN

SoftEther VPN provided by University of Tsukuba SoftEther VPN Project and PacketiX VPN provided by SoftEther Corporation contain multiple vulnerabilities listed below in VPN Client function, and Dynamic DNS Client function included in the VPN server. Heap-based buffer overflow CWE-122 -...