CVE-2024-27903

CRITICAL EPSS 94.6%
Published Jul 8, 20241y ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Jul 8, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
94.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-283
CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 2

VendorProductVersionRange
openvpnopenvpn* <2.5.10
openvpnopenvpn*≥2.6.0  –  <2.6.10

References 3

  • community.openvpn.net https://community.openvpn.net/openvpn/wiki/CVE-2024-27903
    Vendor Advisory
  • openvpn.net https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/
    Vendor Advisory
  • mail-archive.com https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html
    Mailing List

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.