Vulnerability in Openvpn

CVE-2018-7544

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a "signal SIGTERM" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

EPSS exploit prediction

EPSS: 0.018 (78.0th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2018-7544: held from 0.018 to 0.018.

EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: -0.001

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2018-7544?
CVE-2018-7544 is a critical-severity vulnerability in Openvpn, classified under Use of Externally-Controlled Format String. CVSS score: 9.1/10. Published 2018-03-16.
How severe is CVE-2018-7544?
Critical severity. CVSS v3 base score is 9.1 out of 10.