Vulnerability · Published Oct 12, 2023 · Assigned by talos
CVE-2023-27395
Critical 9.0
In plain English
A critical-severity heap buffer overflow in SoftEther VPN from SoftEther VPN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)1.5%top 24.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SoftEther VPN | SoftEther VPN | 4.41-9782-beta5.01.96745.02 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H