CVE-2024-5198 — NULL Pointer Dereference in Openvpn-gui

CWE-476 — NULL Pointer Dereference2 documents2 sources
Severity
3.3LOWNVD
EPSS
0.1%
top 73.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Openvpn Openvpn-guiOpenvpn Ovpn-dcoOpenvpn Ovpn-dco-win
Timeline
PublishedJan 15

Description

OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5openvpn/ovpn-dco1.1.1
▶CVEListV5openvpn/openvpn-gui2.6.10-I002

🔴Vulnerability Details

1
GHSA
GHSA-cp7w-whjm-pp36: OpenVPN ovpn-dco for Windows version 1↗2025-01-15
▶
CVE-2024-5198 — NULL Pointer Dereference in Openvpn-gui | cvebase