PT-2023-15027 · Stormshield · Stormshield Ssl Vpn Client

Daniel Kalinowski · Published 2023-08-05 · Updated 2023-08-09 · CVE-2022-46782

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stormshield SSL VPN Client versions prior to 3.2.0

Description A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the OpenVPN instance until a patch is available.

Fix

Related Identifiers

CVE-2022-46782

Affected Products

Stormshield Ssl Vpn Client

References · 4

• https://advisories.stormshield.eu/2022-028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46782 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46782 · Vendor Advisory
• https://t.me/cvenotify/56101 · Telegram Post