Skip to content
Fencer Vulns
critical 9.1

CVE-2024-5594 json

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected a…

published 2025-01-06 22 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-47154

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

Patch / fix

  • OpenVPN OpenVPN 2.6.11
  • openvpn Debian 12 2.6.3-1+deb12u3
  • openvpn Debian 14, Debian 13 2.6.11-1

debian advisories DEBIAN-CVE-2024-5594

  • openvpn Ubuntu 20.04 LTS 2.4.12-0ubuntu0.20.04.2
  • openvpn Ubuntu 22.04 LTS 2.5.9-0ubuntu0.22.04.3
  • openvpn Ubuntu 24.04 LTS 2.6.9-1ubuntu4.1
  • openvpn Ubuntu Pro 14.04 LTS 2.3.2-7ubuntu3.2+esm2
  • openvpn Ubuntu Pro 16.04 LTS 2.3.10-1ubuntu2.2+esm2
  • openvpn Ubuntu Pro 18.04 LTS 2.4.4-2ubuntu1.7+esm1

ubuntu advisories UBUNTU-CVE-2024-5594

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openvpn SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 2.5.6-150400.3.9.1
  • openvpn SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.6.8-150600.3.14.1
  • openvpn-dco SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.6.8-150600.3.14.1
  • openvpn SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.3.8-16.35.1

suse advisories SUSE-SU-2025:1131-1SUSE-SU-2025:1053-2SUSE-SU-2025:1053-1SUSE-SU-2025:0278-1

  • openvpn openSUSE Tumbleweed 2.6.10-5.1

opensuse advisories openSUSE-SU-2025:14707-1

  • openvpn Alpine 3.17 2.5.10-r1
  • openvpn Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 2.6.11-r0

alpine advisories ALPINE-CVE-2024-5594

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-319-06 updated cvss 5.4

Siemens SCALANCE M-800 Family

  • Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) <V8.2 Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) <V8.2 Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) <V8.2 Siemens SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) <V8.2 Siemens SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) <V8.2 Siemens SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) <V8.2
    +20 more products
    Siemens SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) <V8.2 Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) <V8.2 Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) <V8.2 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) <V8.2 Siemens SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) <V8.2 Siemens SCALANCE M876-3 (6GK5876-3AA02-2BA2) <V8.2 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) <V8.2 Siemens SCALANCE M876-4 (6GK5876-4AA10-2BA2) <V8.2 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) <V8.2 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) <V8.2 Siemens SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) <V8.2 Siemens SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) <V8.2 Siemens SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) <V8.2 Siemens SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) <V8.2 Siemens SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) <V8.2 Siemens SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) <V8.2 Siemens SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) <V8.2 Siemens SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) <V8.2 Siemens SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) <V8.2 Siemens SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) <V8.2
    affected: fixed in V8.2 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-072-02 updated cvss 5.4

Siemens SINEMA Remote Connect Server

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
22 mo ago

Exploit prediction

0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • OpenVPN OpenVPN

Classification

Weakness
  • CWE-1287 Improper Validation of Specified Type of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.