CVE-2024-24974

July 8, 2024, 3:49 p.m.

None
No Score

Description

The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.

Product(s) Impacted

Product Versions
OpenVPN
  • 2.6.9 and earlier

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-923
Improper Restriction of Communication Channel to Intended Endpoints
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

References

https://community.openvpn.net/openvpn/wiki/CVE-2024-24974
https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/
https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html

Tags

2024-07-08
CVE-2024-24974
security@openvpn.net
CWE-923

Timeline

Published: July 8, 2024, 11:15 a.m.
Last Modified: July 8, 2024, 3:49 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@openvpn.net

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.