CVE-2024-27903

2024-07-0810:27:40

CWE-283

OpenVPN

github.com

openvpn

windows

arbitrary plug-in

security vulnerability

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

30.2%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:openvpn:openvpn2:*:*:*:*:*:*:*:*"
    ],
    "vendor": "openvpn",
    "product": "openvpn2",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.6.10",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]