CVE-2021-27406
EUVD-2021-1416014.10.2022, 17:15
An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the back-end server into initializing a new open-VPN instance with arbitrary open-VPN configuration. This could result in the attacker achieving execution with privileges of a SYSTEM user.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| perfact | openvpn-client | 𝑥 ≤ 1.4.1.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-15 - External Control of System or Configuration SettingOne or more system settings or configuration elements can be externally controlled by a user.
- CWE-610 - Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.