PT-2025-1013 · Openvpn · Openvpn Connect

Published 2025-01-06 · Updated 2025-06-10 · CVE-2024-8474

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenVPN Connect versions prior to 3.5.0

Description The issue is related to the logging of clear-text private keys in the application log, which can be used by an unauthorized actor to decrypt VPN traffic. This could allow attackers to access users' private keys, potentially compromising the confidentiality of their VPN traffic. With over 10 million downloads, the potential impact is significant.

Recommendations For OpenVPN Connect versions prior to 3.5.0, update to version 3.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the application log to minimize the risk of exploitation. Additionally, users should check their logs for any signs of unauthorized access.

Fix

Weakness Enumeration

CWE-212

Related Identifiers

BDU:2025-00208

CVE-2024-8474

Affected Products

Openvpn Connect

References · 30

• https://nvd.nist.gov/vuln/detail/CVE-2024-8474 · Security Note
• https://bdu.fstec.ru/vul/2025-00208 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8474 · Vendor Advisory
• https://twitter.com/elhackernet/status/1876598909797056783 · Twitter Post
• https://twitter.com/freedomhack101/status/1876599993970381029 · Twitter Post
• https://twitter.com/The_Cyber_News/status/1876492759781220551 · Twitter Post
• https://twitter.com/EyeofhorusC/status/1876975843173437925 · Twitter Post
• https://twitter.com/cyber_advising/status/1876697413932478603 · Twitter Post
• https://twitter.com/CyberWarship/status/1882421275135513008 · Twitter Post
• https://twitter.com/theodoros377/status/1876753636920803703 · Twitter Post
• https://t.me/cvenotify/125288 · Telegram Post
• https://twitter.com/testalways/status/1876542897241387037 · Twitter Post
• https://twitter.com/fletch_ai/status/1876856568991686765 · Twitter Post
• https://twitter.com/Dinosn/status/1876486253195169834 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1876288499428507801 · Twitter Post