CNNVD-202510-3422 Information
CNNVD ID
CNNVD-202510-3422
Related CVE
- CNNVD Published: 2025-10-24
Description (Chinese)
OpenVPN是美国OpenVPN公司的一个用于创建虚拟专用网络（VPN）加密通道的软件包，它使用OpenSSL库来加密数据与控制信息，并允许创建的VPN使用公开密钥、电子证书或者用户名/密码来进行身份验证。 OpenVPN 2.7_alpha1版本至2.7_beta1版本存在安全漏洞，该漏洞源于使用–dns-updown时远程认证服务器可通过DNS变量注入shell命令。
Description (English)
OpenVPN is a software package for the creation of a virtual private network (VPN) encryption channel at OpenVPN, United States, which uses the OpenSSL library to encrypt data and control information and allows the created VPN to use public keys, electronic certificates or username/cipher for identification. OpenVPN 2.7 alpha1 to 2.7 beta1 contains a security loophole that originates from the use of the –dns-updown remote authentication server to inject shell commands through DNS variables.
Hazard Level
High
Vulnerability Type
其他
Affected Vendor
OpenVPN
Published
2025-10-24
Last Modified
2026-02-24
References
https://community.openvpn.net/Security%20Announcements/CVE-2025-10680 https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00149.html
Share on: