Privilege Escalation via Named Pipe in OpenVPN GUI 2.4.0–2.6.10 Windows
CVE-2024-4877 Published on April 3, 2025

OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges

NVD

Vulnerability Analysis

CVE-2024-4877 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Privilege Chaining

Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.


Products Associated with CVE-2024-4877

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-4877 are published in OpenVPN:

OpenVPN
 

Affected Versions

OpenVPN:

Exploit Probability

EPSS
0.15%
Percentile
36.08%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.