VULNERABILITY INTELLIGENCE

CVE-2025-13086

CVSS score4.6 MEDIUM
EPSS probability0.64%
CISA KEVNot currently listed
Published2025-12-03
Last modified2026-09-25
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Description

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

Weakness classification

  • CWE-940: Improper Verification of Source of a Communication Channel

Primary references