CVE-2017-7522

—

CVSS 3.0

6.5 medium

EPSS

6%p92

Published

Jun 27, 2017 (Jun 27, 2017)

Modified

Jun 17, 2026

Description

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

Vendors: openvpn
Products: openvpn
Weakness: CWE-20, CWE-476
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (5.5%)

In the news2 stories

Critical RCE Flaw Found in OpenVPN that Escaped Two Recent Security Audits

The Hacker NewsJun 22, 08:19 UTC · Jun 22, 2017Vulnerability CVE-2017-7521 CVE-2017-7520 CVE-2017-7508+1 CVEs

OpenVPN fixed several remotely exploitable flaws that were not detected by recent audits

Security AffairsJun 23, 05:44 UTC · Jun 23, 2017Vulnerability CVE-2017-7508 CVE-2017-7521 CVE-2017-7522+1 CVEs