OpenVPN Access Server Vulnerabilities: Risk of Information Exposure, DoS, and RCE (CVE-2023-46849, CVE-2023-46850)

Last week, OpenVPN Access Server, a widely-used open-source VPN solution, received an update addressing two vulnerabilities, tracked as CVE-2023-46849 and CVE-2023-46850. Although CVSS scores for these vulnerabilities are pending, they can enable attackers to gain unauthorized access to sensitive information and, in some cases, facilitate Remote Code Execution (RCE).

OpenVPN is an open-source VPN software providing secure connections through the SSL/TLS protocol.

Which Versions of OpenVPN Access Server Are Affected?

Reportedly, the following versions of OpenVPN Access Server include …

access attackers cases code cve cvss cvss scores dos enable exposure information openvpn rce remote code risk sensitive sensitive information server solution unauthorized access update vpn vulnerabilities week