CVE-2023-27516
12.10.2023, 16:15
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability.Enginsight
| Vendor | Product | Version |
|---|---|---|
| softether | vpn | 4.41-9782:beta |
| softether | vpn | 5.01.9674 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-453 - Insecure Default Variable InitializationThe software, by default, initializes an internal variable with an insecure or less secure value than is possible.
- CWE-1188 - Insecure Default Initialization of ResourceThe software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
References