CVE-2024-38520mediumCWE-400

CVE-2024-38520: falha de média gravidade em SoftEtherVPN

SoftEther VPN with L2TP - 2.75x Amplification

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SoftEther VPN

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it introduces the possibility of the host being used for amplification/reflection traffic generation because it will respond to every packet with two response packets that are larger than the request packet size. These sorts of techniques are used by external actors who generate spoofed source IPs to target a destination on the internet. This vulnerability has been patched in version 5.02.5185.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
SoftEtherVPN · SoftEtherVPN
CVEs relacionadas — SoftEtherVPN

No mesmo produto, das mais perigosas para as menos.

CVE-2026-39312HIGHPre-Auth EAP-TLS DoS on SoftEther VPN Developer EditionEPSS 0.5%CVE-2025-32787LOWSoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRAEPSS 0.4%