CVE-2020-5180

HIGH 7.8CVE-2020-5180 · Published 14/01/2020 · updated 17/06/2026

In short

CVE-2020-5180 is a HIGH (CVSS 7.8) vulnerability affecting viscosity (sparklabs).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
viscosity sparklabs	`= 1.8.2`	No fix yet

Description

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. (When a VPN connection is initiated using a TLS/SSL client profile, the privileges are dropped, and the library will be loaded, resulting in arbitrary code execution as a user with limited privileges. This greatly reduces the impact of the vulnerability.)

References

sparklabs.com/blog/viscosity-for-mac-windows-version-1-8-4 · Release Notes

More vulnerabilities in viscosity

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free