CVE-2023-7235

—

CVSS 3.1

8.4 high

EPSS

<1%p12

Published

Feb 21, 2024 (Feb 21, 2024)

Modified

Jun 17, 2026

Description

The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.

Vendors: openvpn
Products: openvpn gui
Weakness: CWE-276
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.