CVE-2024-5198

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5198
OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://community.openvpn.net/openvpn/wiki/CVE-2024-5198 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openvpn:ovpn-dco-win:1.1.1:*:*:*:*:*:*:*
History

10 Jun 2025, 16:12

Type Values Removed Values Added
References () https://community.openvpn.net/openvpn/wiki/CVE-2024-5198 - () https://community.openvpn.net/openvpn/wiki/CVE-2024-5198 - Vendor Advisory
CPE cpe:2.3:a:openvpn:ovpn-dco-win:1.1.1:*:*:*:*:*:*:*
First Time Openvpn ovpn-dco-win
Openvpn

15 Jan 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3
Summary
  • (es) OpenVPN ovpn-dco para Windows versión 1.1.1 permite que un atacante local sin privilegios envíe mensajes de control de E/S con datos no válidos al controlador, lo que genera una desreferencia de puntero NULL que provoca la detención del sistema.

15 Jan 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-15 13:15

Updated : 2025-06-10 16:12

NVD link : CVE-2024-5198

Mitre link : CVE-2024-5198

CVE.ORG link : CVE-2024-5198

JSON object : View

Products Affected

openvpn

  • ovpn-dco-win
CWE
CWE-476

NULL Pointer Dereference