SoftEther VPN vulnerabilities
We track 6 vulnerabilities in SoftEther VPN products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2023.
Latest SoftEther VPN vulnerabilities
- 7.4 High severity
SoftEther VPN: Channel Accessible by Non-Endpoint
An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability.
- 7.8 High severity
SoftEther VPN: Initialization of a Resource with an Insecure Default
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnera
- 8.1 High severity
SoftEther VPN: Out-of-bounds Write
A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the
- 7.5 High severity
SoftEther VPN: Uncontrolled Resource Consumption
A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connections can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this
- 7.5 High severity
SoftEther VPN: Out-of-bounds Read
A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service.
- 7.5 High severity
SoftEther VPN: Integer Underflow (Wrap or Wraparound)
An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability