CVE-2025-2704

EPSS 0.16%
Published 02.04.2025 21:15:32
Last modified 24.05.2025 01:38:01
Source security@openvpn.net
Teams watchlist Login
Open Login

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase

Affected products Warnungen 0 Metrics 2 CWE 1 References 5

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

This information is available to logged-in users.

Data is provided by the National Vulnerability Database (NVD)

Openvpn ≫ Openvpn SwEditioncommunity Version >= 2.6.1 <= 2.6.13

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.16%	0.374

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

https://community.openvpn.net/openvpn/wiki/CVE-2025-2704

Broken Link

http://www.openwall.com/lists/oss-security/2025/04/02/5

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2025-2704

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-2704

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-2704

EUVD