Vulnerability Description
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openvpn | Openvpn | < 2.5.10 |
Related Weaknesses (CWE)
References
- https://community.openvpn.net/openvpn/wiki/CVE-2024-27903Vendor Advisory
- https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-202Vendor Advisory
- https://www.mail-archive.com/[email protected]/msg07534.htmlMailing List
- https://community.openvpn.net/openvpn/wiki/CVE-2024-27903Vendor Advisory
- https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-202Vendor Advisory
- https://www.mail-archive.com/[email protected]/msg07534.htmlMailing List
FAQ
What is CVE-2024-27903?
CVE-2024-27903 is a vulnerability with a CVSS score of 9.8 (CRITICAL). OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged O...
How severe is CVE-2024-27903?
CVE-2024-27903 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-27903?
Check the references section above for vendor advisories and patch information. Affected products include: Openvpn Openvpn.