« Volver al listado

CVE-2024-27459

Estado: ModificadaAlta (7.8)—

The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openvpn — Openvpn

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-27459",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-27459",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-23T15:31:20.276661Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@openvpn.net",
      "affectedData": [
        {
          "vendor": "OpenVPN",
          "product": "OpenVPN GUI",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.9 and earlier"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:openvpn:openvpn_gui:*:*:*:*:*:*:*:*"
          ],
          "vendor": "openvpn",
          "product": "openvpn_gui",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.6.9"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-08T11:15:10.303",
  "references": [
    {
      "url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27459",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html",
      "tags": [
        "Mailing List"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27459",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@openvpn.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges."
    },
    {
      "lang": "es",
      "value": "El servicio interactivo en OpenVPN 2.6.9 y versiones anteriores permite a un atacante enviar datos provocando un desbordamiento de pila que puede usarse para ejecutar código arbitrario con más privilegios."
    }
  ],
  "lastModified": "2026-06-17T07:19:56.150",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62343D14-4C89-4E6F-9C74-46E7EEAF79CB",
              "versionEndExcluding": "2.5.10"
            },
            {
              "criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E77CFBC-2014-4588-B77C-C34E333645A7",
              "versionEndExcluding": "2.6.10",
              "versionStartIncluding": "2.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@openvpn.net"
}