Vulnerability Details : CVE-2024-5594
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
Products affected by CVE-2024-5594
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2024-5594
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 24 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2024-5594
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
3.9
|
5.2
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-01-06 |
CWE ids for CVE-2024-5594
-
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.Assigned by:
- 36a55730-e66d-4d39-8ca6-3c3b3017965e (Primary)
- security@openvpn.net (Secondary)
References for CVE-2024-5594
-
https://community.openvpn.net/openvpn/wiki/CVE-2024-5594
Just a moment...
-
https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html
[Openvpn-users] OpenVPN 2.6.11 released
Jump to