Command Injection Vulnerability in OpenVPN-Monitor by Furlongm
CVE-2021-31605

7.5HIGH

Key Information:

Vendor
Openvpn-monitor Project
Status
Openvpn-monitor
Vendor
CVE Published:
27 September 2021

Summary

A critical command injection vulnerability exists in OpenVPN-Monitor versions prior to 1.1.3, exposing users to risks via the OpenVPN management interface socket. Attackers can exploit this weakness to inject malicious commands, possibly leading to unauthorized server shutdowns through the SIGTERM signal. It is essential for users to update to the latest version to safeguard their systems against potential exploits.

References

https://github.com/furlongm/openvpn-monitor/releases
x_refsource_MISC
http://packetstormsecurity.com/files/164278/OpenVPN-Monit...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.