Unrated severityNVD Advisory· Published May 19, 2025· Updated May 20, 2025

CVE-2025-3908

Description

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.

Affected products

OpenVPN/OpenVPNllm-fuzzy
Range: >=20, <=24
OpenVPN/OpenVPN 3 Linuxv5
Range: v20

Patches

Vulnerability mechanics

References

community.openvpn.net/Security%20Announcements/CVE-2025-3908mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000