CVE-2021-27406

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the back-end server into initializing a new open-VPN instance with arbitrary open-VPN configuration. This could result in the attacker achieving execution with privileges of a SYSTEM user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-15CWE-610

Affected software

VendorProductVersions
PerFactOpenVPN-Client>= unspecified, <= 1.4.1.0

References

Timeline

Published
Oct 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-274087.5The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chaiCVE-2021-274109.8The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn meCVE-2021-274116.5Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCCVE-2021-274127.8Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitCVE-2021-274137.8Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, whicCVE-2021-274146.1An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 iCVE-2021-274165.4An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and inclCVE-2021-274179.8eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc).CVE-2021-274186.1GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user inputCVE-2021-274199.8uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can leaCVE-2021-274205.3GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the wCVE-2021-274219.8NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory loc
CVE-2021-27406: High severity, CVSS 8.8 | Vulnix