Vulnerability Spotlight: CVE-2018-3952 / CVE-2018-4010 - Multi-provider VPN Client Privilege Escalation Vulnerabilities
Summary: Cisco Talos researchers found privilege escalation vulnerabilities in multi-provider VPN clients that let a standard user execute arbitrary commands through OpenVPN with administrator privileges, similar to CVE-2018-10169 discovered by VerSprite in April 2018. The clients' patches for that earlier flaw could be bypassed because the configuration file parser accepts keywords inside quotation marks, so a crafted config still loads a plugin DLL and runs code as administrator.
Key Takeaway: A patch the vendors already shipped for the April 2018 bug did not stop the attack, and the bypass required only a quoted keyword in a configuration file a standard user can send to the service.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-10169CVE-2018-3952CVE-2018-4010
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026