CVE-2021-35523

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-35523

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-35523.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2021-35523

Related

GHSA-v8p8-4w8f-qh34

Published

2021-06-28T17:15:08.083Z

Modified

2026-01-31T17:32:02.734940Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.

References

Affected packages

Git / github.com/securepoint/openvpn-client

Affected ranges

Type: GIT
Repo: https://github.com/securepoint/openvpn-client
Events: Introduced

e4e33f1ca7b5e3751ccd984fe291b76c2bdb0d61

Fixed

c8c4c339da255cf3050a88a1e91c94e8e25c2eef

Affected versions

2.*

2.0.15

2.0.16

2.0.17

2.0.18

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.30-release

2.0.31

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-35523.json"