CVE-2025-25567: Buffer Copy without Checking Size of Input

SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function. NOTE: the Supplier disputes this because the behavior only enables a local user to attack himself through the UI,...

SoftEther VPN security vulnerability

SoftEther VPN is a free and open source, cross-platform, multi-protocol VPN software from SoftEther Open Source. It is used to provide secure, flexible and efficient network connectivity that bypasses geographic restrictions. A security vulnerability exists in SoftEther VPN version 5.02.5187, whi...

PT-2025-11089 · Unknown · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEther VPN version 5.02.5187 Description: The issue is related to a Buffer Overflow in the Command.c file, specifically via the PtMakeCert and PtMakeCert2048 functions. Recommendations: For SoftEther VPN version 5.02.5187, consider disabli...

CVE-2025-25565

SoftEther VPN version 5.02.5187 is vulnerable to a Buffer Overflow in the Command.c file, specifically affecting the PtMakeCert and PtMakeCert2048 functions. While the supplier disputes the severity, claiming the behavior only allows a user to attack themselves by entering a long string on a comm...

SoftEther VPN security vulnerability

SoftEther VPN is a free and open source, cross-platform, multi-protocol VPN software from SoftEther Open Source. It is used to provide secure, flexible and efficient network connectivity that bypasses geographic restrictions. A security vulnerability exists in SoftEther VPN version 5.02.5187 that...

SoftEther VPN security vulnerability

SoftEther VPN is a free and open source, cross-platform, multi-protocol VPN software from SoftEther Open Source. It is used to provide secure, flexible and efficient network connectivity that bypasses geographic restrictions. A security vulnerability exists in SoftEther VPN version 5.02.5187, whi...

China-Aligned MirrorFace Hackers Target EU Diplomats with World Expo 2025 Bait

The China-aligned threat actor known as MirrorFace has been observed targeting a diplomatic organization in the European Union, marking the first time the hacking crew has targeted an entity in the region. "During this attack, the threat actor used as a lure the upcoming World Expo, which will be...

SoftEther VPN Security Vulnerability

SoftEther VPN is an open source, cross-platform, multi-protocol VPN Virtual Private Network application. A security vulnerability exists prior to SoftEther VPN version 5.02.5185 that stems from the fact that when L2TP is enabled on a device to deploy SoftEtherVPN, two response packets larger than...

PT-2024-28048 · Softether · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEtherVPN versions prior to 5.02.5185 Description: The issue arises when SoftEtherVPN is deployed with L2TP enabled, allowing the host to be used for amplification/reflection traffic generation. This occurs because the program responds to...

RedJuliett Cyber Espionage Campaign Hits 75 Taiwanese Organizations

A likely China-linked state-sponsored threat actor has been linked to a cyber espionage campaign targeting government, academic, technology, and diplomatic organizations in Taiwan between November 2023 and April 2024. Recorded Future's Insikt Group is tracking the activity under the name...

SoftEther VPN DCRegister DoS

The vulnerability of the DCRegister function in the SoftEther VPN client involves executing a loop with an unreachable exit condition. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

CVE-2023-25774

A denial-of-service vulnerability exists in the vpnserver ConnectionAccept functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability...

CVE-2023-27516

An authentication bypass vulnerability exists in the CiRpcAccepted functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability...

CVE-2023-32634

An authentication bypass vulnerability exists in the CiRpcServerThread functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability...

CVE-2023-32634

An authentication bypass vulnerability exists in the CiRpcServerThread functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability...

CVE-2023-25774

A denial-of-service vulnerability exists in the vpnserver ConnectionAccept functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability...

CVE-2023-27516

An authentication bypass vulnerability exists in the CiRpcAccepted functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability...

CVE-2023-31192

An information disclosure vulnerability exists in the ClientConnect functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2023-27395

A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this...

CVE-2023-32275

An information disclosure vulnerability exists in the CtEnumCa functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability...