CVE-2023-7235

Published: Feb 21, 2024Modified: Jun 17, 2026

8.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.5 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.

Affected (1)

Products: Openvpn: Openvpn Gui

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openvpn Openvpn Gui	Before 2.6.9

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (2)

https://community.openvpn.net/openvpn/wiki/CVE-2023-7235

Source: security@openvpn.net

Permissions Required

https://community.openvpn.net/openvpn/wiki/CVE-2023-7235

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

Timeline

No history available yet.