Untrusted search path in OpenVPN for Windows - CVE-2024-27903

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU87677

Untrusted search path in OpenVPN for Windows - CVE-2024-27903

Published: March 20, 2024 / Updated: March 25, 2024


Vulnerability identifier: #VU87677
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-27903
CWE-ID: CWE-426
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path in plugins. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.

The vulnerability affects Windows installations only.


Affected software

OpenVPN for Windows
SINEMA Remote Connect Client

How to mitigate CVE-2024-27903

Install updates from vendor's website.

OpenVPN for Windows - addressed in versions 2.5.10, 2.6.10
SINEMA Remote Connect Client - update to 3.2 SP3

External References

Related Security Bulletins