CVE-2023-7245

The nodejs framework in OpenVPN Connect versions 3.0 through 3.4.3 (Windows) and 3.0 through 3.4.7 (macOS) is vulnerable to arbitrary code execution. The root cause is a misconfiguration that fails to neutralize instructions in dynamically executed code, allowing a local user to execute code with...

CVE-2021-3613

CVE-2021-3613 affects OpenVPN Connect for Windows (versions 3.2.0–3.3.0). A local user can load arbitrary dynamic loadable libraries via an OpenSSL configuration file, enabling arbitrary code execution with the same privileges as OpenVPNConnect.exe. Public sources confirm the affected range and i...

CVE-2020-15075

OpenVPN Connect for macOS is affected: installer versions 3.2.6 and older may corrupt system files via symlinks in /tmp. Root cause described as improper access to /tmp symlinks enabling modification of critical files. Public documents describe impact as potential file corruption but do not provi...

CVE-2020-9442

OpenVPN Connect 3.1.0.361 for Windows stores a TAP driver DLL under %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, and insecure file permissions allow local users to copy a malicious drvstore.dll to gain privileges. This CVE (CVE-2020-9442) is documented with a local-privilege-escalation ...

CVE-2023-7224

The CVE-2023-7224 issue affects OpenVPN Connect on macOS, version 3.0–3.4.6. The vulnerability arises when a local user can cause execution of code in external third‑party libraries via the DYLD_INSERT_LIBRARIES environment variable, indicating a local code‑execution risk. Documents confirm the a...

CVE-2024-8474

OpenVPN Connect versions prior to 3.5.0 are vulnerable to the exposure of sensitive information. The application may log the configuration profile's clear-text private key into the application log, which could be accessed by an unauthorized actor. If obtained, this key can be used to decrypt VPN ...

CVE-2022-3761

OpenVPN Connect on macOS and Windows is affected by CVE-2022-3761 due to errors in the certificate authentication procedure, allowing a man-in-the-middle attacker to intercept requests for downloading configuration profiles that contain user credentials. Affected versions include macOS before 3.4...

CVE-2026-9560

Summary: CVE-2026-9560 affects OpenVPN Connect for macOS (versions 3.5.1–3.8.1). Affected component is the background service that can escalate privileges via a local IPC channel, allowing an attacker to execute arbitrary commands with elevated privileges. The CVSS metrics indicate a high-impact,...