PT-2025-2972 · Itop Vpn · Itop Vpn

Jonathanlauener · Published 2024-11-20 · Updated 2025-02-03 · CVE-2024-53588

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iTop VPN version 16.0

Description A DLL hijacking issue allows attackers to execute arbitrary code by placing a crafted DLL file into the path ProgramDataiTop VPNDownloadervpn6. This enables attackers to trick iTop VPN into loading a fake DLL file, resulting in the execution of malicious code.

Recommendations For iTop VPN version 16.0, as a temporary workaround, consider restricting access to the ProgramDataiTop VPNDownloadervpn6 path to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2026-06575

CVE-2024-53588

Affected Products

Itop Vpn

References · 10

• https://bdu.fstec.ru/vul/2026-06575 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-53588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-53588 · Security Note
• https://github.com/JonathanLauener/iTop-privesc · Note
• https://t.me/cvedetector/16240 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1886300610842018054 · Twitter Post
• https://vulners.com/cve/CVE-2024-53588 · Note
• https://t.me/cvenotify/108581 · Telegram Post
• https://vuldb.com/de/?id.293210 · Note
• https://twitter.com/CVEnew/status/1882612842802958488 · Twitter Post