Securepoint Ssl Vpn Client V2
Monthly
Argument injection through proxy settings, plus an unchecked checksum-update path in the privileged service, in Securepoint SSL VPN Client v2 on Windows let a non-privileged local user steer OpenVPN operations that execute with NT AUTHORITY\SYSTEM privileges, producing high integrity and availability impact (VC:N/VI:H/VA:H). The proxy-settings vector is the more accessible one: it requires only the ability to set the client's proxy options and needs neither communication with the privileged service nor modification of the protected OpenVPN configuration. Exploitation requires a pre-existing local session on the affected Windows host (AV:L, PR:L, UI:N), so this is a post-foothold local privilege escalation rather than a remote entry point; no public exploit code or confirmed active exploitation is identified in the available data, and the vendor-reported advisory is the reference of record.
Argument injection through proxy settings, plus an unchecked checksum-update path in the privileged service, in Securepoint SSL VPN Client v2 on Windows let a non-privileged local user steer OpenVPN operations that execute with NT AUTHORITY\SYSTEM privileges, producing high integrity and availability impact (VC:N/VI:H/VA:H). The proxy-settings vector is the more accessible one: it requires only the ability to set the client's proxy options and needs neither communication with the privileged service nor modification of the protected OpenVPN configuration. Exploitation requires a pre-existing local session on the affected Windows host (AV:L, PR:L, UI:N), so this is a post-foothold local privilege escalation rather than a remote entry point; no public exploit code or confirmed active exploitation is identified in the available data, and the vendor-reported advisory is the reference of record.