Medium severity6.2NVD Advisory· Published May 19, 2025· Updated Jun 17, 2026
CVE-2025-3908
CVE-2025-3908
Description
The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:openvpn:openvpn3linux:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:openvpn:openvpn3linux:*:*:*:*:*:*:*:*range: >=20,<=24
- (no CPE)range: v20-v24
- (no CPE)range: v20
Patches
Vulnerability mechanics
References
2- community.openvpn.net/Security%20Announcements/CVE-2025-3908nvdVendor Advisory
- www.openwall.com/lists/oss-security/2025/05/20/2nvdMailing List
News mentions
0No linked articles in our index yet.