CVE-2024-27903

CRITICAL

OpenVPN < 2.5.10 - Unrestricted Plugin Upload via Untrusted Directory

Title source: llm
STIX 2.1

Description

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0892
EPSS Percentile 94.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-283 CWE-434
Status published
Products (1)
openvpn/openvpn < 2.5.10
Published Jul 08, 2024
Tracked Since Feb 18, 2026