PT-2023-4938 · Softether · Softether Vpn
CVSS v3.1
9.0
Crítica
| Vetor | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SoftEther VPN versions 4.41-9782-beta through 5.02
Description
A heap-based buffer overflow vulnerability exists in the
WpcParsePacket() functionality. This issue can be triggered by a specially crafted network packet, potentially leading to arbitrary code execution. An attacker can exploit this vulnerability by performing a man-in-the-middle attack.Recommendations
For versions 4.41-9782-beta through 5.02, consider disabling the
WpcParsePacket() function as a temporary workaround until a patch is available. Restrict access to the vpnserver functionality to minimize the risk of exploitation. Avoid using the vulnerable functionality in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Memory Corruption
Heap Based Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Softether Vpn