Softether vulnerabilities
We track 9 vulnerabilities in Softether products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on March 12, 2025.
Latest Softether vulnerabilities
- 9.8 Critical severity
VPN: Use After Free
SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function. NOTE: the Supplier disputes this because the use-after-free is not in the VPN software, but is instead in a separate tool that has no untrus
- 9.8 Critical severity
VPN: Buffer Copy without Checking Size of Input
SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function. NOTE: the Supplier disputes this because the behavior only enables a local user to attack himself through the UI,
- 9.8 Critical severity
VPN: Buffer Copy without Checking Size of Input
SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes this because the behavior only allows a user to attack himself by typing a long string on a command line
- 7.4 High severity
SoftEther VPN: Channel Accessible by Non-Endpoint
An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability.
- 7.8 High severity
SoftEther VPN: Initialization of a Resource with an Insecure Default
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnera
- 8.1 High severity
SoftEther VPN: Out-of-bounds Write
A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the
- 7.5 High severity
SoftEther VPN: Uncontrolled Resource Consumption
A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this
- 7.5 High severity
SoftEther VPN: Out-of-bounds Read
A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service.
- 7.5 High severity
SoftEther VPN: Integer Underflow (Wrap or Wraparound)
An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability