CVE-2024-27903

Openvpn vulnerability

9.8 CRITICALEPSS 8.92%

Published8 Jul 2024

Description

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Openvpn≥ 2.6.0 < 2.6.10 · < 2.5.10

Remediation

Fixed in

Openvpn≥ 2.6.10

Frequently asked

Is CVE-2024-27903 being actively exploited?

CVE-2024-27903 is not in the CISA KEV catalog. Its EPSS exploit probability is 8.92%.

How severe is CVE-2024-27903?

CVE-2024-27903 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 8.92% probability of exploitation.

Which products are affected by CVE-2024-27903?

Affected products include Openvpn.

How do I fix CVE-2024-27903?

Upgrade affected software to a fixed version, for example Openvpn 2.6.10 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-27903 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.