CVE-2023-7235

HIGH 8.4CVE-2023-7235 · Published 21/02/2024 · updated 17/06/2026

In short

CVE-2023-7235 is a HIGH (CVSS 8.4) vulnerability affecting openvpn gui (openvpn).
Chance of exploitation in the next 30 days (EPSS): 0.21%, higher than 11.8% of all vulnerabilities.
Fix: update to 2.6.9 or later.

Package	Affected versions	Patched versions
openvpn gui openvpn	`< 2.6.9`	`2.6.9`

Description

The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.

References

community.openvpn.net/openvpn/wiki/CVE-2023-7235 · Permissions Required

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free