{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"OpenVPN 2","source":"CNA: OpenVPN","vendor":"OpenVPN","versions":[{"status":"affected","version":"2.6.9 and earlier"}]},{"defaultStatus":"unknown","product":"openvpn2","source":"ADP: CISA-ADP","vendor":"openvpn","versions":[{"lessThan":"2.6.10","status":"affected","version":"0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*","versionEndExcluding":"2.5.10","vulnerable":true},{"criteria":"cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*","versionEndExcluding":"2.6.10","versionStartIncluding":"2.6.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-27903","cwes":["CWE-283","CWE-434"],"description":"OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.","epss":{"date":"2026-11-03","percentile":0.95245,"score":0.08922},"exploits":[],"kev":null,"metrics":[{"score":7.2,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.8,"severity":"critical","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.2,"severity":"high","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793750136993,"publishedAt":1720434460125,"references":[{"source":"CNA: OpenVPN","tags":[],"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-27903"},{"source":"CNA: OpenVPN","tags":[],"url":"https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"},{"source":"CNA: OpenVPN","tags":[],"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-27903"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"},{"source":"security@openvpn.net","tags":["Vendor Advisory"],"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-27903"},{"source":"security@openvpn.net","tags":["Vendor Advisory"],"url":"https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"},{"source":"security@openvpn.net","tags":["Mailing List"],"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-27903"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"}],"remediation":[],"revision":"dab9f0e4d572c11ade067af896bd9e5ebae79b4323e2114e6fd3da2c53bb44b7","sources":[{"modifiedAt":1793750136993,"name":"CNA: OpenVPN","retrievedAt":1793750951580,"url":"https://www.cve.org/CVERecord?id=CVE-2024-27903"},{"modifiedAt":1793744236907,"name":"NVD","retrievedAt":1793751358982,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27903"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793743930999,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-27903"}],"ssvc":{"assessedAt":1724385336482,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2024-27903","updatedAt":1793751358982}