« Back to list

CVE-2024-8474

Status: AnalyzedHigh (7.5)—

OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

AV:N/AC:L/PR:N permite T1190 (app expuesta). La vulnerabilidad expone claves privadas en logs de OpenVPN, permitiendo lectura de credenciales (T1552.001) y descifrado de tráfico (T1040 - sniffing de red).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Network SegmentationVulnerability ScanningUser TrainingUser Account ManagementRestrict File and Directory PermissionsPrivileged Account Management

Affected technologies (1)

Openvpn — Connect

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2024-8474",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8474",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-06T16:53:43.249831Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@openvpn.net",
      "affectedData": [
        {
          "vendor": "OpenVPN",
          "product": "OpenVPN Connect",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "all releases",
              "lessThanOrEqual": "3.5.0"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-06T15:15:14.983",
  "references": [
    {
      "url": "https://openvpn.net/connect-docs/android-release-notes.html",
      "tags": [
        "Release Notes"
      ],
      "source": "security@openvpn.net"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@openvpn.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-212"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic"
    },
    {
      "lang": "es",
      "value": "OpenVPN Connect anterior a la versión 3.5.0 puede contener la clave privada en texto plano del perfil de configuración que se registra en el registro de la aplicación, que un actor no autorizado puede usar para descifrar el tráfico VPN."
    }
  ],
  "lastModified": "2026-06-17T08:22:40.657",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openvpn:connect:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C5CCC69-B938-4CCE-98B3-0B8064C987F1",
              "versionEndExcluding": "3.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@openvpn.net"
}