What’s Vulnerable › Vulnerabilities

CVE-2021-45810

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-22 · updated 2026-06-17

Description

GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService through DBUS, GUI. The way GlobalProtect-Openconnect is set up enables arbitrary users to start a VPN connection to arbitrary servers. By hosting an openconnect compatible server, the attack can redirect the entire host's traffic via their own server.

Affected products

• Globalprotect-Openconnect Project Globalprotect-Openconnect: all versions

References

• https://github.com/yuezk/GlobalProtect-openconnect/issues/114
• https://github.com/yuezk/GlobalProtect-openconnect/issues/114#issuecomment-1914008203
• https://github.com/yuezk/GlobalProtect-openconnect/issues/114
• https://github.com/yuezk/GlobalProtect-openconnect/issues/114#issuecomment-1914008203

Get alerted when CVE-2021-45810 or the next vulnerability affects your stack