CVE-2020-9442: High severity OpenVPN Connect vulnerability
Published Feb 28, 2020
·Updated
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.
Affected Software
4 affected components
OpenVPN Connect<=3.1.0.361
Microsoft Windows
All of the following
OpenVPN Connect<=3.1.0.361
Microsoft Windows
Event History
Feb 28, 2020
CVE Published
via MITRE·01:40 PM
Data Sourced
via MITRE·01:40 PM
Description
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2020-9442?
CVE-2020-9442 is a vulnerability that exists in OpenVPN Connect 3.1.0.361 on Windows.
2
What is the severity of CVE-2020-9442?
The severity of CVE-2020-9442 is high, with a CVSS score of 7.8.
3
How does CVE-2020-9442 affect OpenVPN Connect on Windows?
CVE-2020-9442 allows local users to gain privileges by copying a malicious drvstore.dll to %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10.
4
Is Microsoft Windows affected by CVE-2020-9442?
No, Microsoft Windows is not vulnerable to CVE-2020-9442.
5
How can I fix CVE-2020-9442?
To fix CVE-2020-9442, update OpenVPN Connect to a version that has addressed the vulnerability.