A binary planting vulnerability in OpenVPN for Windows allows local authenticated users to achieve arbitrary code execution by exploiting an insecure search path.

This flaw exists because the tapctl utility invokes netsh.exe without a fully qualified path. A local authenticated attacker can leverage this untrusted search path to perform binary planting and gain unauthorized code execution.

The CVSS score of 8.5 underscores the critical nature of this local privilege escalation vector. If exploited, an attacker with local access can gain full control over the system, potentially leading to unauthorized data access, persistence, or lateral movement within the network.

Immediate Action: Update OpenVPN on all Windows hosts to version 2.7.7 to resolve the insecure search path implementation.

Proactive Monitoring: Monitor system logs for unexpected execution of binaries from temporary directories or unusual calls to netsh.exe by the OpenVPN process.

Compensating Controls: Apply strict file system permissions to prevent untrusted users from placing malicious binaries in directories that are searched by the application.

Public Exploit Available: No

Organizations should treat this as a high priority for Windows environments. Upgrading to the latest version is the only effective way to correct the path handling logic and prevent potential local exploitation.