What’s Vulnerable › Vulnerabilities

CVE-2006-2229

• Severity: medium (CVSS 4.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2006-05-05 · updated 2026-06-16

Description

OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service.

Affected products

• OpenVPN: 2.0, 2.0.1_rc1, 2.0.1_rc2, 2.0.1_rc3, 2.0.1_rc4, 2.0.1_rc5 (+74)
• OpenVPN Access Server: 2.0.1, 2.0.2, 2.0.5, 2.0.6, 2.0.7

References

• http://openvpn.net/man.html
• http://www.osvdb.org/25660
• http://www.securityfocus.com/archive/1/432863/100/0/threaded
• http://www.securityfocus.com/archive/1/432867/100/0/threaded
• http://www.securityfocus.com/archive/1/433000/100/0/threaded
• http://openvpn.net/man.html
• http://www.osvdb.org/25660
• http://www.securityfocus.com/archive/1/432863/100/0/threaded
• http://www.securityfocus.com/archive/1/432867/100/0/threaded
• http://www.securityfocus.com/archive/1/433000/100/0/threaded

Get alerted when CVE-2006-2229 or the next vulnerability affects your stack