PT-2020-16181 · Safervpn · Safervpn

Published 2020-09-18 · Updated 2020-09-25 · CVE-2020-25744

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SaferVPN versions prior to 5.0.3.3

Description The issue allows low-privileged users to create or overwrite arbitrary files, potentially causing a denial of service (DoS) condition. This is because a symlink from %LOCALAPPDATA%SaferVPNLog is followed.

Recommendations For versions prior to 5.0.3.3, update to version 5.0.3.3 or later to resolve the issue.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2020-25744

Affected Products

Safervpn

References · 5

• 🔥 https://medium.com/@thebinary0x1/safervpn-for-windows-arbitrary-file-overwrite-dos-bdc88fdb5ead · Exploit
• 🔥 https://youtube.com/watch?v=0QdRJdA_aos · Exploit
• https://osv.dev/vulnerability/CVE-2020-25744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25744 · Security Note
• https://medium.com/%40thebinary0x1/safervpn-for-windows-arbitrary-file-overwrite-dos-bdc88fdb5ead · Note