Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2025-10680: OpenVPN: Remote Code Injection via DNS on POSIX Platforms
CVE-2025-10680 · published 1 year ago
Summary
OpenVPN's DNS functionality on POSIX systems allows a malicious server to inject and execute shell commands on a client's system when using the --dns-updown option. This could allow an attacker to gain unauthorized access to the client's system. Update to a fixed version of OpenVPN to mitigate this risk.
Original advisory text
OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use
OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published24 Oct 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-10680 · NVD
Track software like this
Free during beta