CVE-2021-27406

Published: Oct 14, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the back-end server into initializing a new open-VPN instance with arbitrary open-VPN configuration. This could result in the attacker achieving execution with privileges of a SYSTEM user.

Affected (1)

Products: Perfact: Openvpn Client

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Perfact Openvpn Client	Up to 1.4.1.0

Related CWEs

External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user.

Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsa-21-056-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-21-056-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.