Non-standard installation path vulnerability in OpenVPN GUI installer allows arbitrary file execution
CVE-2023-7235

Currently unrated

Key Information:

Vendor
Openvpn
Status
Openvpn
Vendor
CVE Published:
21 February 2024

Summary

The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.

Affected Version(s)

OpenVPN Windows 0 <= 2.6.8

References

https://community.openvpn.net/openvpn/wiki/CVE-2023-7235

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.