CVE-2023-7235

HIGH

OpenVPN GUI < 2.6.9 - Unauthenticated Arbitrary Code Execution via Installation Directory Permissions

Title source: llm

Description

The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.

References (1)

Core 1

Core References

Permissions Required

https://community.openvpn.net/openvpn/wiki/CVE-2023-7235

Scores

CVSS v3 8.4

EPSS 0.0021

EPSS Percentile 11.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-276

Status published

Products (1)

openvpn/openvpn_gui < 2.6.9

Published Feb 21, 2024

Tracked Since Feb 18, 2026