Read the docs
TI-2018-07527 Aliases CVE-2018-10645GHSA-95r2-wrvc-pcfh

Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation…

Priority LOW 34CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. The "SetProperty" method allows an attacker to configure the "AdditionalOpenVpnParameters" property and control the OpenVPN command line. Using the OpenVPN "plugin" parameter, an attacker may specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user. This attack may be conducted using "VyprVPN Free" account credentials and the VyprVPN Desktop Client.

Why it matters now

EPSS 0.00339 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:goldenfrog:vyprvpn:2.12.1.8015:*:*:*:*:windows:*:*2.12.1.8015VulnerableGoldenfrog
  • cpe:2.3:a:goldenfrog:vyprvpn:2.12.1.8015:*:*:*:*:windows:*:* Versions 2.12.1.8015 Vulnerable ·Goldenfrog

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-10645
  2. 2026-10-03 Alias added: GHSA-95r2-wrvc-pcfh

References

Advisory 1

  • TI-2017-13046 In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has… CVSS 3.0HIGH 7.8
  • TI-2018-09432 Golden Frog VyprVPN before 2018-06-21 has a vulnerability associated with the installation process on Windows. CVSS 3.0HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences