CVE-2021-3606: High severity OpenVPN OpenVPN vulnerability
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenVPN (Windows)to a version that resolves this vulnerability.Fixed in 2.5.3 - Compensating control
Ensure untrusted local users cannot access the OpenSSL configuration file that OpenVPN reads (so they cannot supply a malicious configuration to load arbitrary dynamic loadable libraries).
Event History
Frequently Asked Questions
What is CVE-2021-3606?
CVE-2021-3606 is a vulnerability in OpenVPN before version 2.5.3 on Windows that allows local users to load arbitrary dynamic loadable libraries.
How does CVE-2021-3606 impact Windows users?
CVE-2021-3606 allows local users on Windows to load arbitrary dynamic loadable libraries, which can lead to running arbitrary code with the same privilege level as the main OpenVPN process.
What is the severity level of CVE-2021-3606?
CVE-2021-3606 has a severity rating of 7.8 (high).
How can I fix CVE-2021-3606?
To fix CVE-2021-3606, users should update OpenVPN to version 2.5.3 or higher.
Where can I find more information about CVE-2021-3606?
More information about CVE-2021-3606 can be found on the OpenVPN community website: [OpenVPN CVE-2021-3606](https://community.openvpn.net/openvpn/wiki/CVE-2021-3606)