CVE-2024-8474

OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@openvpn.net

Published

2025-01-06

Last modified

2025-01-06

Weaknesses

CWE-212

Affected products

• Connect (Openvpn)
• Openvpn Connect (Openvpn)

References

• https://openvpn.net/connect-docs/android-release-notes.html