Vendors / SoftEther VPN Records 15 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 7
Exploited now SoftEther VPN records in CISA KEV No SoftEther VPN vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00588 · Published 2025-03-12 · No fix listed CWE-416
Priority HIGH 82
SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00598 · Published 2025-03-12 · No fix listed CWE-120
Priority HIGH 82
SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0063 · Published 2025-03-12 · No fix listed CWE-120
Priority HIGH 72
SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00468 · Published 2026-04-07 · No fix listed CWE-789
Priority HIGH 69
An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta.
CVSS 3.1 HIGH 7.8· Local · No auth · User interaction · EPSS 0.00426 · Published 2023-10-12 · No fix listed CWE-300
Priority HIGH 67
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0053 · Published 2023-10-12 · No fix listed CWE-453
Priority MEDIUM 60
A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02.
CVSS 3.1 MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00957 · Published 2023-10-12 · No fix listed CWE-835
Priority MEDIUM 58
Memory Leak vulnerability in SoftEtherVPN 5.02.5187 allows an attacker to cause a denial of service via the UnixMemoryAlloc function.
CVSS 3.1 MEDIUM 5.6· Network · No auth · No interaction · EPSS 0.00316 · Published 2025-03-12 · No fix listed CWE-401
Priority MEDIUM 58
An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674.
CVSS 3.1 MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00392 · Published 2023-10-12 · No fix listed CWE-201
Priority MEDIUM 57
An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674.
CVSS 3.1 MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00968 · Published 2023-10-12 · No fix listed CWE-457
Priority MEDIUM 44
A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02.
CVSS 3.1 CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.01543 · Published 2023-10-12 · No fix listed CWE-122
Priority MEDIUM 40
A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00841 · Published 2023-10-12 · No fix listed CWE-400
Priority MEDIUM 40
A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00841 · Published 2023-10-12 · No fix listed CWE-125
Priority LOW 34
An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00841 · Published 2023-10-12 · No fix listed CWE-191
Priority LOW 34
See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00354 · Published 2019-07-29 · No fix listed CWE-787
Open these records in search → All records by CVSS severity
4 7 4 0 0
THREATIST.IORead the docs