Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18 vulnerabilities found for SoftEther VPN by SoftEther VPN
CVE-2023-32634 (GCVE-0-2023-32634)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2025-11-04 19:16
VLAI?
Summary
An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability.
Severity ?
7.8 (High)
CWE
- CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T19:16:23.506Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1755"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:4.41-9782:beta:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "4.41-9782"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32634",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T18:23:15.009192Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T18:25:53.739Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-300",
"description": "CWE-300: Channel Accessible by Non-Endpoint (\u0027Man-in-the-Middle\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:07.639Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-32634",
"datePublished": "2023-10-12T15:27:51.751Z",
"dateReserved": "2023-06-02T14:34:08.115Z",
"dateUpdated": "2025-11-04T19:16:23.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-32275 (GCVE-0-2023-32275)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2025-11-04 19:16
VLAI?
Summary
An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability.
Severity ?
5.5 (Medium)
CWE
- CWE-201 - Information Exposure Through Sent Data
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T19:16:04.891Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1753"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:4.41-9782:beta:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "4.41-9782"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32275",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T18:13:28.822856Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T18:16:57.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201: Information Exposure Through Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:08.274Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-32275",
"datePublished": "2023-10-12T15:27:52.706Z",
"dateReserved": "2023-06-02T14:34:01.906Z",
"dateUpdated": "2025-11-04T19:16:04.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-31192 (GCVE-0-2023-31192)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2025-11-04 19:15
VLAI?
Summary
An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity ?
5.3 (Medium)
CWE
- CWE-457 - Use of Uninitialized Variable
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
5.01.9674
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T19:15:58.051Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1768"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-31192",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T18:27:29.595048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T18:28:17.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457: Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:07.044Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-31192",
"datePublished": "2023-10-12T15:27:51.300Z",
"dateReserved": "2023-06-12T22:01:57.282Z",
"dateUpdated": "2025-11-04T19:15:58.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-27516 (GCVE-0-2023-27516)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2024-08-02 12:16
VLAI?
Summary
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability.
Severity ?
7.3 (High)
CWE
- CWE-453 - Insecure Default Variable Initialization
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:16:36.884Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1754"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:4.41-9782:beta:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "4.41-9782"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-27516",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-01T15:14:30.646891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-01T15:15:22.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-453",
"description": "CWE-453: Insecure Default Variable Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:07.942Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-27516",
"datePublished": "2023-10-12T15:27:52.223Z",
"dateReserved": "2023-06-02T14:34:05.095Z",
"dateUpdated": "2024-08-02T12:16:36.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-27395 (GCVE-0-2023-27395)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2024-08-02 12:09
VLAI?
Summary
A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity ?
9 (Critical)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:09:43.368Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1735"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether_vpn:softether_vpn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "softether_vpn",
"vendor": "softether_vpn",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-27395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-01T14:17:00.605505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-01T14:23:32.492Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:09.356Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-27395",
"datePublished": "2023-10-12T15:27:54.988Z",
"dateReserved": "2023-03-24T14:44:29.371Z",
"dateUpdated": "2024-08-02T12:09:43.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25774 (GCVE-0-2023-25774)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2024-08-02 11:32
VLAI?
Summary
A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Severity ?
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
5.01.9674
Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:32:12.619Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1743"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1743",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1743"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.02:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.02"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25774",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T21:16:47.704947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T21:17:38.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:06.743Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1743",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1743"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-25774",
"datePublished": "2023-10-12T15:27:53.149Z",
"dateReserved": "2023-04-14T16:48:36.218Z",
"dateUpdated": "2024-08-02T11:32:12.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-23581 (GCVE-0-2023-23581)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2024-08-02 10:35
VLAI?
Summary
A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service.
Severity ?
7.5 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
5.01.9674
Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:35:33.372Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1741"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.02:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.02"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-23581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T21:14:55.337741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T21:16:20.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:06.413Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-23581",
"datePublished": "2023-10-12T15:27:53.612Z",
"dateReserved": "2023-04-04T14:56:22.884Z",
"dateUpdated": "2024-08-02T10:35:33.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-22325 (GCVE-0-2023-22325)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2024-08-02 10:07
VLAI?
Summary
A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity ?
5.9 (Medium)
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:07:06.113Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1736"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:4.41-9782:beta:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "4.41-9782"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.02:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.02"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22325",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T20:32:28.975799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T20:39:42.379Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:08.927Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-22325",
"datePublished": "2023-10-12T15:27:54.526Z",
"dateReserved": "2023-03-24T14:45:06.682Z",
"dateUpdated": "2024-08-02T10:07:06.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-22308 (GCVE-0-2023-22308)
Vulnerability from nvd – Published: 2023-10-12 15:27 – Updated: 2024-08-02 10:07
VLAI?
Summary
An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
Severity ?
7.5 (High)
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
5.01.9674
Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:07:06.157Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1737"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1737",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1737"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:08.609Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1737",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1737"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-22308",
"datePublished": "2023-10-12T15:27:54.061Z",
"dateReserved": "2023-03-24T14:45:23.224Z",
"dateUpdated": "2024-08-02T10:07:06.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-27395 (GCVE-0-2023-27395)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2024-08-02 12:09
VLAI?
Summary
A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity ?
9 (Critical)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:09:43.368Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1735"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether_vpn:softether_vpn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "softether_vpn",
"vendor": "softether_vpn",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-27395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-01T14:17:00.605505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-01T14:23:32.492Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:09.356Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-27395",
"datePublished": "2023-10-12T15:27:54.988Z",
"dateReserved": "2023-03-24T14:44:29.371Z",
"dateUpdated": "2024-08-02T12:09:43.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-22325 (GCVE-0-2023-22325)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2024-08-02 10:07
VLAI?
Summary
A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity ?
5.9 (Medium)
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:07:06.113Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1736"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:4.41-9782:beta:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "4.41-9782"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.02:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.02"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22325",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T20:32:28.975799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T20:39:42.379Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:08.927Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-22325",
"datePublished": "2023-10-12T15:27:54.526Z",
"dateReserved": "2023-03-24T14:45:06.682Z",
"dateUpdated": "2024-08-02T10:07:06.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-22308 (GCVE-0-2023-22308)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2024-08-02 10:07
VLAI?
Summary
An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
Severity ?
7.5 (High)
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
5.01.9674
Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:07:06.157Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1737"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1737",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1737"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:08.609Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1737",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1737"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-22308",
"datePublished": "2023-10-12T15:27:54.061Z",
"dateReserved": "2023-03-24T14:45:23.224Z",
"dateUpdated": "2024-08-02T10:07:06.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-23581 (GCVE-0-2023-23581)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2024-08-02 10:35
VLAI?
Summary
A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service.
Severity ?
7.5 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
5.01.9674
Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:35:33.372Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1741"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.02:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.02"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-23581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T21:14:55.337741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T21:16:20.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:06.413Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-23581",
"datePublished": "2023-10-12T15:27:53.612Z",
"dateReserved": "2023-04-04T14:56:22.884Z",
"dateUpdated": "2024-08-02T10:35:33.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25774 (GCVE-0-2023-25774)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2024-08-02 11:32
VLAI?
Summary
A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Severity ?
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
5.01.9674
Affected: 5.02 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:32:12.619Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1743"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1743",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1743"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.02:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.02"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25774",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T21:16:47.704947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T21:17:38.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
},
{
"status": "affected",
"version": "5.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:06.743Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1743",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1743"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-25774",
"datePublished": "2023-10-12T15:27:53.149Z",
"dateReserved": "2023-04-14T16:48:36.218Z",
"dateUpdated": "2024-08-02T11:32:12.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32275 (GCVE-0-2023-32275)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2025-11-04 19:16
VLAI?
Summary
An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability.
Severity ?
5.5 (Medium)
CWE
- CWE-201 - Information Exposure Through Sent Data
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T19:16:04.891Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1753"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:4.41-9782:beta:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "4.41-9782"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32275",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T18:13:28.822856Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T18:16:57.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201: Information Exposure Through Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:08.274Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-32275",
"datePublished": "2023-10-12T15:27:52.706Z",
"dateReserved": "2023-06-02T14:34:01.906Z",
"dateUpdated": "2025-11-04T19:16:04.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-27516 (GCVE-0-2023-27516)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2024-08-02 12:16
VLAI?
Summary
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability.
Severity ?
7.3 (High)
CWE
- CWE-453 - Insecure Default Variable Initialization
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:16:36.884Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1754"
},
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:4.41-9782:beta:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "4.41-9782"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-27516",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-01T15:14:30.646891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-01T15:15:22.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-453",
"description": "CWE-453: Insecure Default Variable Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:07.942Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-27516",
"datePublished": "2023-10-12T15:27:52.223Z",
"dateReserved": "2023-06-02T14:34:05.095Z",
"dateUpdated": "2024-08-02T12:16:36.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32634 (GCVE-0-2023-32634)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2025-11-04 19:16
VLAI?
Summary
An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability.
Severity ?
7.8 (High)
CWE
- CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
4.41-9782-beta
Affected: 5.01.9674 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T19:16:23.506Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1755"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:4.41-9782:beta:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "4.41-9782"
}
]
},
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32634",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T18:23:15.009192Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T18:25:53.739Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "4.41-9782-beta"
},
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-300",
"description": "CWE-300: Channel Accessible by Non-Endpoint (\u0027Man-in-the-Middle\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:07.639Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-32634",
"datePublished": "2023-10-12T15:27:51.751Z",
"dateReserved": "2023-06-02T14:34:08.115Z",
"dateUpdated": "2025-11-04T19:16:23.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-31192 (GCVE-0-2023-31192)
Vulnerability from cvelistv5 – Published: 2023-10-12 15:27 – Updated: 2025-11-04 19:15
VLAI?
Summary
An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity ?
5.3 (Medium)
CWE
- CWE-457 - Use of Uninitialized Variable
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SoftEther VPN | SoftEther VPN |
Affected:
5.01.9674
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T19:15:58.051Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"tags": [
"x_transferred"
],
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1768"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:softether:vpn:5.01.9674:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn",
"vendor": "softether",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-31192",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T18:27:29.595048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T18:28:17.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SoftEther VPN",
"vendor": "SoftEther VPN",
"versions": [
{
"status": "affected",
"version": "5.01.9674"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457: Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T17:00:07.044Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768"
},
{
"name": "https://www.softether.org/9-about/News/904-SEVPN202301",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-31192",
"datePublished": "2023-10-12T15:27:51.300Z",
"dateReserved": "2023-06-12T22:01:57.282Z",
"dateUpdated": "2025-11-04T19:15:58.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}