CVE-2024-27903

CriticalCVSS 9.8/10Last modified Nov 3, 2026

Description

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-283CWE-434

Affected software

VendorProductVersions
OpenVPNOpenVPN 22.6.9 and earlier
openvpnopenvpn2< 2.6.10

References

Timeline

Published
Jul 8, 2024
Last modified
Nov 3, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-279059.1** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint expoCVE-2024-279065.9Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they dCVE-2024-279077.8A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds writeCVE-2024-279084.9A buffer overflow vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in denial of service.CVE-2024-279094.9A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot.CVE-2024-27915.4The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in allCVE-2024-279105.3A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authenticatiCVE-2024-279117.5A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password.CVE-2024-279127.5A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending CVE-2024-279136.5ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash)CVE-2024-279146.1GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-279158.1Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardl
CVE-2024-27903: Critical severity, CVSS 9.8 | Vulnix