VULNERABILITY INTELLIGENCE

CVE-2020-15074

CVSS score7.5 HIGH
EPSS probability1.04%
CISA KEVNot currently listed
Published2020-07-14
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp.

Weakness classification

  • security@openvpn.net: CWE-302
  • nvd@nist.gov: CWE-613

Primary references