CVE-2018-10204

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-18 · updated 2026-06-17
Weakness: CWE-732

Description

PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" service. When configured to use the OpenVPN protocol, the "sevpnclient" service executes "openvpn.exe" using the OpenVPN config file located at %PROGRAMDATA%\purevpn\config\config.ovpn. This file allows "Write" permissions to users in the "Everyone" group. An authenticated attacker may modify this file to specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM account.

Affected products

PureVPN: 6.0.1

References

https://github.com/VerSprite/research/blob/master/advisories/VS-2018-021.md
https://github.com/VerSprite/research/blob/master/advisories/VS-2018-021.md

Get alerted when CVE-2018-10204 or the next vulnerability affects your stack