CVE-2018-10647

HIGH 7.8CVE-2018-10647 · Published 02/05/2018 · updated 17/06/2026

In short

CVE-2018-10647 is a HIGH (CVSS 7.8) vulnerability affecting safervpn (safervpn).
Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 27.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
safervpn safervpn	`= 4.2.5`	No fix yet

Description

SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service. The "SaferVPN.Service" service executes "openvpn.exe" using OpenVPN config files located within the current user's %LOCALAPPDATA%\SaferVPN\OvpnConfig directory. An authenticated attacker may modify these configuration files to specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.

References

VerSprite/research · Third Party Advisory

More vulnerabilities in safervpn

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free