CYPHERLOCK, INC.

Severe OpenVPN Flaws Risk Remote Code Execution on Millions of Devices

Recent investigations by Microsoft have unveiled several medium-level security flaws within OpenVPN, a prominent open-source VPN solution utilized across numerous sectors such as IT, finance, telecommunications, and software development, on platforms like Windows, iOS, macOS, Android, and BSD.

These vulnerabilities present risks including remote code execution (RCE) and local privilege escalation (LPE), potentially enabling attackers to gain full control of affected devices. Such breaches could lead to unauthorized data access, system breaches, and exposure of confidential information.

The issues were found in the client-side components of OpenVPN, particularly in the interaction between the openvpn.exe application and the openvpnserv.exe service. The problematic versions encompass all releases before OpenVPN 2.6.10 and 2.5.10.

The specific vulnerabilities identified are:

  • CVE-2024-27459: A stack overflow issue in openvpnserv that could cause a denial-of-service (DoS) attack and LPE on Windows.
  • CVE-2024-24974: An unauthorized access flaw permitting remote interactions with the \openvpn\service named pipe on Windows.
  • CVE-2024-27903: A defect in the plugin system leading to RCE on Windows and LPE or data manipulation across Android, iOS, macOS, and BSD.
  • CVE-2024-1305: A memory overflow issue in the Windows TAP driver resulting in DoS.

Exploiting these vulnerabilities requires proper user authentication and an in-depth understanding of OpenVPN’s framework. Attackers might combine these flaws to perform a coordinated attack, leading to RCE and LPE and thus full control over targeted systems, which could result in data breaches, system compromises, and unauthorized information access.

In March 2024, Microsoft informed OpenVPN about these vulnerabilities through Coordinated Vulnerability Disclosure. OpenVPN has released updates to address these issues, and users are strongly advised to upgrade to versions 2.6.10 or 2.5.10 to reduce potential threats. Further recommendations include:

  • Isolating OpenVPN clients from the broader internet and unauthorized users.
  • Enforcing stringent authentication practices and limiting user write permissions.
  • Monitoring for unusual activity and maintaining updated endpoint security.

To address these risks, OpenVPN users should promptly update to the latest versions (2.6.10 or 2.5.10).

To check if your OpenVPN version is current, run:

openvpn --version

Updating to the latest OpenVPN versions will enhance security and provide access to the newest features and improvements.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day