CVE-2024-27903

CRITICAL

OpenVPN <2.6.9 - Path Traversal

Title source: llm
STIX 2.1

Description

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0699
EPSS Percentile 91.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434 CWE-283
Status published
Products (1)
openvpn/openvpn < 2.5.10
Published Jul 08, 2024
Tracked Since Feb 18, 2026