PT-2014-6485 · Openvpn · Openvpn Connect+1

Gjoko Krstic · Published 2014-08-25 · Updated 2026-05-28 · CVE-2014-5455

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PrivateTunnel versions prior to 3.0 OpenVPN Connect versions prior to 3.1

Description The issue allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder, due to an unquoted Windows search path vulnerability in the ptservice service.

Recommendations For PrivateTunnel versions prior to 3.0, update to version 3.0 or later. For OpenVPN Connect versions prior to 3.1, update to version 3.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2014-5455

Affected Products

Openvpn Connect

Privatetunnel

References · 10

• 🔥 https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d · Exploit
• 🔥 https://github.com/CVEProject/cvelist/pull/3909 · Exploit
• 🔥 http://exploit-db.com/exploits/34037 · Exploit
• 🔥 http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/34037 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php · Exploit
• https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5455 · Security Note
• https://t.me/cveNotify/165071 · Telegram Post
• http://osvdb.org/show/osvdb/109007 · Note