The VPN component in Windscribe 1.81 uses the OpenVPN client for connections.

published 2018-05-25 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-3510

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 9.6%; EPSS 9.6% chance of exploitation in 30 days, percentile 95%
public exploits: 2; Metasploit, Exploit-DB

The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pipe\WindscribeService named pipe endpoint that allows the Windscribe VPN process to connect and execute an OpenVPN process or other processes (like taskkill, etc.). There is no validation of the program name before constructing the lpCommandLine argument for a CreateProcess call. An attacker can run any malicious process with SYSTEM privileges through this named pipe.

Timeline

2018-05-24 First public exploit (Metasploit exploit/windows/local/windscribe_windscribeservice_priv_esc)
2018-05-25 Published

Exploit prediction

9.58% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/windows/local/windscribe_windscribeservice_priv_esc Windscribe WindscribeService Named Pipe Privilege Escalation metasploit exploit, excellent rank, 2018-05-24
EDB-48021 Windscribe - WindscribeService Named Pipe Privilege Escalation (Metasploit) local, 2020-02-07

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-20 Improper Input Validation

References

Sources

CVE List CVE-2018-11479
NVD CVE-2018-11479

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary