CVE-2021-35523

Name of the Vulnerable Software and Affected Versions: Securepoint SSL VPN Client versions prior to 2.0.32

Description: The issue concerns unsafe configuration handling that enables local privilege escalation to NT AUTHORITYSYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%Securepoint SSL VPN" and add an external script file that is executed as a privileged user.

Recommendations: For versions prior to 2.0.32, update to version 2.0.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the OpenVPN configuration stored under "%APPDATA%Securepoint SSL VPN" to prevent non-privileged users from modifying it. Additionally, avoid using external script files in the OpenVPN configuration until the issue is resolved.