CVE-2024-28882

MEDIUM EPSS 47.1%

Published Jul 8, 20241y ago · Modified Jun 17, 20261w ago

4.3 CVSS 3.1

Medium

Published Jul 8, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session

CVSS Details

Base Score

4.3

Exploitability

2.8

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability Low

Threat Intelligence

EPSS Exploit Probability

47.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-772

Affected Products 1

Vendor	Product	Version	Range
openvpn	openvpn	*	≥2.6.0 – <2.6.11

References 2

community.openvpn.net https://community.openvpn.net/openvpn/wiki/CVE-2024-28882

Vendor Advisory
mail-archive.com https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html

Mailing List

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.