What’s Vulnerable › Vulnerabilities

CVE-2018-10645

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-02 · updated 2026-06-17
• Weakness: CWE-732

Description

Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. The "SetProperty" method allows an attacker to configure the "AdditionalOpenVpnParameters" property and control the OpenVPN command line. Using the OpenVPN "plugin" parameter, an attacker may specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user. This attack may be conducted using "VyprVPN Free" account credentials and the VyprVPN Desktop Client.

Affected products

• Goldenfrog Vyprvpn: 2.12.1.8015

References

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-025.md
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-025.md

Get alerted when CVE-2018-10645 or the next vulnerability affects your stack