CVE Feed

    Dashboard / CVE / CVE-2018-10204

    CVE-2018-10204

    PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" service. When configured to use the OpenVPN protocol, the "sevpnclient" service executes "openvpn.exe" using the OpenVPN config file located at %PROGRAMDATA%\purevpn\config\config.ovpn. This file allows "Write" permissions to users in the "Everyone" group. An authenticated attacker may modify this file to specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM account.

    Published:Apr 18, 2018
    Last Modified:Nov 21, 2024
    EPS:Apr 18, 2018
    EPSS Score:0.00515
    CVSS Score:8.8

    Affected Products

    Vendor
    Purevpn
    Product
    Purevpn

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-59691 (CVSS 3.7) — PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel …
    CVE-2025-59692 (CVSS 3.7) — PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's exi…
    CVE-2023-48957 (CVSS 5.3) — PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN t…
    CVE-2018-18656 (CVSS 7.8) — The PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in cleartext. The…
    CVE-2018-7484 (CVSS 7.8) — An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone gr…
    CVE-2018-6822 (CVSS 9.8) — In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High