PT-2026-136244
CVE-2026-97350
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 4.0
6.9
MediumMetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Securepoint SSL VPN Client version 2
Description
Issues in the handling of OpenVPN configurations and proxy settings on Windows allow non-privileged local users to influence operations executed with NT AUTHORITYSYSTEM privileges. Two attack vectors exist: first, improper authorization during configuration checksum updates allows a local user to modify an OpenVPN configuration and set a valid checksum without administrator rights, which is then processed by the privileged service. Second, the client fails to validate or sanitize proxy settings before passing them as arguments to OpenVPN, enabling a local user to perform argument injection to influence the execution of OpenVPN with system privileges. This second vector does not require direct communication with the privileged service or modification of protected configurations.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾