Local Configuration Manipulation Vulnerability in OpenVPN by OpenVPN Technologies
CVE-2025-3908

6.2MEDIUM

Key Information:

Vendor

Openvpn
Status
Openvpn 3 Linux
Vendor
CVE Published:
19 May 2025

What is CVE-2025-3908?

The configuration initialization tool in OpenVPN 3 Linux versions 20 through 24 allows local attackers to exploit symlinks that may unintentionally direct permissions and ownership changes to arbitrary directories. This can lead to unauthorized access to sensitive data or modifications within the system, posing significant security risks to affected installations.

Affected Version(s)

OpenVPN 3 Linux Linux v20

References

https://community.openvpn.net/Security%20Announcements/CV...

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-3908 : Local Configuration Manipulation Vulnerability in OpenVPN by OpenVPN Technologies