Read the docs
TI-2021-02552 Aliases CVE-2021-3606GHSA-3c2r-pvhv-53p8

Uncontrolled search path in OpenVPN-GUI

Priority LOW 34CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).

Why it matters now

EPSS 0.00344 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—OpenVPN-GUI2.5.2 and prior releases—No fix listedCNA
  • OpenVPN-GUI Vendor— Affected 2.5.2 and prior releases Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*before 2.5.3VulnerableOpenVPN
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:* Versions before 2.5.3 Vulnerable ·OpenVPN
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3606
  2. 2026-10-03 Alias added: GHSA-3c2r-pvhv-53p8

References

Advisory 2

  • TI-2014-04453 Unquoted Windows search path vulnerability in the ptservice service prior to… CVSS 3.1MEDIUM 5.3
  • TI-2022-00467 Authentication bypass in OpenVPN CVSS 3.1CRITICAL 9.8
  • TI-2024-18509 Unrestricted file upload in OpenVPN 2 CVSS 3.1CRITICAL 9.8
  • TI-2024-16468 The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to… CVSS 3.1HIGH 7.5
  • TI-2023-25309 Use after free in OpenVPN 2 CVSS 3.1CRITICAL 9.8
  • TI-2024-05196 OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker… CVSS 3.1CRITICAL 9.1
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences