« Volver al listado

CVE-2024-24974

Estado: ModificadaAlta (7.5)—

The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openvpn — Openvpn

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-24974",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-24974",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-09T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@openvpn.net",
      "affectedData": [
        {
          "vendor": "OpenVPN",
          "modules": [
            "Interactive Service"
          ],
          "product": "OpenVPN 2",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.9 and earlier"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*"
          ],
          "vendor": "openvpn",
          "product": "openvpn",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.5.10",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:openvpn:openvpn:2.6.0:-:*:*:community:*:*:*"
          ],
          "vendor": "openvpn",
          "product": "openvpn",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.0",
              "lessThan": "2.6.10",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-07-08T11:15:10.103",
  "references": [
    {
      "url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-24974",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html",
      "tags": [
        "Mailing List"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-24974",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@openvpn.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-923"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service."
    },
    {
      "lang": "es",
      "value": "El servicio interactivo en OpenVPN 2.6.9 y versiones anteriores permite acceder remotamente al canal del servicio OpenVPN, lo que permite a un atacante remoto interactuar con el servicio interactivo privilegiado OpenVPN."
    }
  ],
  "lastModified": "2026-06-17T07:15:18.780",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62343D14-4C89-4E6F-9C74-46E7EEAF79CB",
              "versionEndExcluding": "2.5.10"
            },
            {
              "criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E77CFBC-2014-4588-B77C-C34E333645A7",
              "versionEndExcluding": "2.6.10",
              "versionStartIncluding": "2.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@openvpn.net"
}