PT-2025-14766 · Openvpn+1 · Openvpn+1

Published 2024-05-14 · Updated 2025-04-03 · CVE-2024-4877

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.4.0 through 2.6.10

Description The issue allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to, enabling it to escalate its privileges.

Recommendations For OpenVPN versions 2.4.0 through 2.6.10, consider restricting access to the named pipe creation functionality to prevent privilege escalation until a patch is available. As a temporary workaround, consider disabling the OpenVPN GUI component on Windows systems to minimize the risk of exploitation.

Fix

LPE

Weakness Enumeration

CWE-268

CWE-166

Related Identifiers

ALT-PU-2024-10642

ALT-PU-2024-10859

ALT-PU-2024-10885

BDU:2025-03850

CVE-2024-4877

Affected Products

Alt Linux

Openvpn

References · 14

• https://osv.dev/vulnerability/ALPINE-CVE-2024-4877 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03850 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-4877 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4877 · Vendor Advisory
• https://mail-archive.com/[e-mail]/msg07634.html · Note
• https://t.me/cvedetector/21996 · Telegram Post
• https://community.openvpn.net/openvpn/wiki/CVE-2024-4877 · Note
• https://vuldb.com/?id.303243 · Note
• https://abf.rosa.ru/advisories/ROSA-SA-2025-2939 · Note
• https://community.openvpn.net/openvpn/wiki/OpenVPNInteractiveService · Note
• https://twitter.com/CVEnew/status/1907913657427833029 · Twitter Post
• https://t.me/cvetracker/20712 · Telegram Post
• https://op-c.net/blog/vulnerabilities-patched-in-openvpn-2-6-11-cve-2024-5594-cve-2024-4877-cve-2024-28882 · Note
• https://security.alpinelinux.org/vuln/CVE-2024-4877 · Note