CVE-2018-10647 | BDVDB-2026-100341 Detail

Description#

SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service. The "SaferVPN.Service" service executes "openvpn.exe" using OpenVPN config files located within the current user's %LOCALAPPDATA%\SaferVPN\OvpnConfig directory. An authenticated attacker may modify these configuration files to specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/VerSprite/research/blob/master/advisories/VS-2018-024.md

Exploit#

No public exploit known

History#

Version 12018-05-02Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.