CVE-2020-5180

Description

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. (When a VPN connection is initiated using a TLS/SSL client profile, the privileges are dropped, and the library will be loaded, resulting in arbitrary code execution as a user with limited privileges. This greatly reduces the impact of the vulnerability.)

7.8

CVSS

Severity: High

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.07%

Vendor Advisory sparklabs.com

Affected: n/a n/a

References

Link	Tags
https://www.sparklabs.com/blog/viscosity-for-mac-windows-version-1-8-4/	release notes vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-5180?: CVE-2020-5180 has been scored as a high severity vulnerability.
How to fix CVE-2020-5180?: To fix CVE-2020-5180, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2020-5180 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2020-5180 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.