CVE-2023-27395

CVE-2023-27395 is a heap-based buffer overflow in SoftEther VPN’s vpnserver WpcParsePacket() used by SoftEther VPN 4.41-9782-beta, 5.01.9674, and 5.02. A specially crafted network packet can trigger arbitrary code execution, with the attacker able to perform a man-in-the-middle attack to trigger ...

CVE-2025-25568

SoftEtherVPN version 5.02.5187 is affected by a Use after Free vulnerability located in the Command.c file, specifically within the CheckNetworkAcceptThread function. While the software supplier disputes this finding, claiming the issue exists only in a separate, non-exposed stress-testing tool f...

CVE-2025-25565

SoftEther VPN version 5.02.5187 is vulnerable to a Buffer Overflow in the Command.c file, specifically affecting the PtMakeCert and PtMakeCert2048 functions. While the supplier disputes the severity, claiming the behavior only allows a user to attack themselves by entering a long string on a comm...

CVE-2023-22325

CVE-2023-22325 affects SoftEther VPN, specifically the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality. A specially crafted network packet can trigger a denial-of-service condition, with MITM usage noted in some descriptions. Affected versions include SoftEther VPN 4.41-9782-beta, 5.01.9674, and ...

CVE-2025-25567

SoftEther VPN version 5.02.5187 is vulnerable to a Buffer Overflow in the Internat.c file, specifically within the UniToStrForSingleChars function. The supplier disputes the severity, claiming the behavior only allows a local user to attack themselves through the UI. As a temporary workaround, it...

CVE-2023-32275

CVE-2023-32275 concerns SoftEther VPN and PacketiX VPN. The vulnerability lies in the CtEnumCa() function, affecting SoftEther VPN versions 4.41-9782-beta and 5.01.9674. By sending specially crafted network packets, an attacker can trigger information disclosure, exposing sensitive data. Several ...

CVE-2023-31192

The CVE-2023-31192 entry concerns SoftEther VPN 5.01.9674. The vulnerability resides in the ClientConnect() function and is an information-disclosure issue triggered by specially crafted network packets, potentially enabling a man-in-the-middle to exfiltrate sensitive data. Affected component/fil...

CVE-2023-25774

CVE-2023-25774: Talos reports a denial-of-service in SoftEther VPN 5.01.9674 and 5.02 due to a vulnerability in vpnserver ConnectionAccept() that can exhaust resources by spawning many threads. Root cause appears to be synchronization/locking leading to long delays and eventual server crash under...

CVE-2023-27516

CVE-2023-27516 affects SoftEther VPN 4.41-9782-beta and 5.01.9674, where a flaw in the CiRpcAccepted() function allows authentication bypass via a specially crafted network packet, enabling unauthorized access. The Red Hat, JVN, and other records corroborate the affected versions and the specific...

CVE-2025-25566

A memory leak vulnerability exists in SoftEtherVPN version 5.02.5187 within the UnixMemoryAlloc function. This flaw could allow an attacker to cause a denial of service (DoS). However, the supplier disputes the severity, noting the behavior is limited to a single allocation of a few hundred bytes...

CVE-2023-23581

CVE-2023-23581 is a SoftEther VPN vulnerability in the vpnserver EnSafeHttpHeaderValueStr function. Talos confirms denial-of-service via specially crafted network packets, affecting SoftEther VPN server versions 5.01.9674 and 5.02. The root cause is an out-of-bounds read triggered during HTTP hea...

CVE-2023-22308

CVE-2023-22308 affects SoftEther VPN vpnserver OpenVPN support. Talos reports an integer underflow in OvsProcessData handling for TCP OpenVPN data, enabling a crafted TCP packet to crash the server (denial of service). OpenVPN traffic is identified by the first two bytes 0x00 0x0E in TCP mode; UD...

CVE-2023-32634

CVE-2023-32634 affects SoftEther VPN (CiRpcServerThread) and enables an authentication bypass that can be exploited by a local attacker to mount a man-in-the-middle and access/modify communications. Public listings consistently name SoftEther VPN versions 5.01.9674 and 4.41-9782-beta as affected,...