CVE-2025-3908: Medium severity openvpn vulnerability
The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3908?
CVE-2025-3908 is considered to have a medium severity level due to its ability to allow local attackers to modify directory permissions.
How do I fix CVE-2025-3908?
To fix CVE-2025-3908, upgrade to OpenVPN 3 Linux version 25 or newer, which addresses the vulnerability.
Who is affected by CVE-2025-3908?
CVE-2025-3908 affects users of OpenVPN 3 Linux versions 20 to 24.
What does CVE-2025-3908 exploit?
CVE-2025-3908 exploits symlink vulnerabilities in the configuration initialization tool, allowing modifications to directory ownership and permissions.
Can CVE-2025-3908 lead to further attacks?
Yes, CVE-2025-3908 can potentially lead to privilege escalation and unauthorized access due to altered directory permissions.