{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"OpenVPN 2","source":"CNA: OpenVPN","vendor":"OpenVPN","versions":[{"status":"affected","version":"2.6.9 and earlier"}]},{"defaultStatus":"unaffected","product":"openvpn","source":"ADP: CISA-ADP","vendor":"openvpn","versions":[{"lessThan":"2.5.10","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"openvpn","source":"ADP: CISA-ADP","vendor":"openvpn","versions":[{"lessThan":"2.6.10","status":"affected","version":"2.6.0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*","versionEndExcluding":"2.5.10","vulnerable":true},{"criteria":"cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*","versionEndExcluding":"2.6.10","versionStartIncluding":"2.6.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-24974","cwes":["CWE-923"],"description":"The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.","epss":{"date":"2026-11-03","percentile":0.95536,"score":0.09759},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793744235597,"publishedAt":1720434034520,"references":[{"source":"CNA: OpenVPN","tags":[],"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-24974"},{"source":"CNA: OpenVPN","tags":[],"url":"https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"},{"source":"CNA: OpenVPN","tags":[],"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-24974"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"},{"source":"security@openvpn.net","tags":["Vendor Advisory"],"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-24974"},{"source":"security@openvpn.net","tags":["Vendor Advisory"],"url":"https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"},{"source":"security@openvpn.net","tags":["Mailing List"],"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-24974"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"}],"remediation":[],"revision":"50651a505631e396dcf5296f431e5af4cbe6d060c224211f03ffa665ebbabedd","sources":[{"modifiedAt":1793742753565,"name":"CNA: OpenVPN","retrievedAt":1793743872895,"url":"https://www.cve.org/CVERecord?id=CVE-2024-24974"},{"modifiedAt":1793744235597,"name":"NVD","retrievedAt":1793751358809,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24974"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793743932204,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-24974"}],"ssvc":{"assessedAt":1722364735346,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2024-24974","updatedAt":1793751358809}