Vulnerability in Goldenfrog Vyprvpn
CVE-2017-17809
In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forcing the VyprVPN application to load a malicious dynamic library every time a new connection is made.
EPSS: 0.008 (52.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Goldenfrog Vyprvpn
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-17809?
- CVE-2017-17809 is a high-severity vulnerability in Goldenfrog Vyprvpn, classified under Untrusted Search Path. CVSS score: 7.8/10. Published 2017-12-20.
- How severe is CVE-2017-17809?
- High severity. CVSS v3 base score is 7.8 out of 10.