CVE-2024-24974
Full vulnerability record from the local CVENow database.
Description
The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2024-07-08 11:15:10.103000
Last modified
2026-11-03 22:17:15.597000
View original CVE JSON
{
"id": "CVE-2024-24974",
"sourceIdentifier": "[email protected]",
"published": "2024-07-08T11:15:10.103",
"lastModified": "2026-11-03T22:17:15.597",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service."
},
{
"lang": "es",
"value": "El servicio interactivo en OpenVPN 2.6.9 y versiones anteriores permite acceder remotamente al canal del servicio OpenVPN, lo que permite a un atacante remoto interactuar con el servicio interactivo privilegiado OpenVPN."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "OpenVPN",
"product": "OpenVPN 2",
"defaultStatus": "unaffected",
"modules": [
"Interactive Service"
],
"platforms": [
"Windows"
],
"versions": [
{
"version": "2.6.9 and earlier",
"status": "affected"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"vendor": "openvpn",
"product": "openvpn",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "0",
"lessThan": "2.5.10",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "openvpn",
"product": "openvpn",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:openvpn:openvpn:2.6.0:-:*:*:community:*:*:*"
],
"versions": [
{
"version": "2.6.0",
"lessThan": "2.6.10",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-07-30T18:38:55.346204Z",
"id": "CVE-2024-24974",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-923"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"versionEndExcluding": "2.5.10",
"matchCriteriaId": "62343D14-4C89-4E6F-9C74-46E7EEAF79CB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"versionStartIncluding": "2.6.0",
"versionEndExcluding": "2.6.10",
"matchCriteriaId": "0E77CFBC-2014-4588-B77C-C34E333645A7"
}
]
}
]
}
],
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-24974",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mail-archive.com/[email protected]/msg07534.html",
"source": "[email protected]",
"tags": [
"Mailing List"
]
},
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-24974",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mail-archive.com/[email protected]/msg07534.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
]
}
]
}