CVE-2026-97350— Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows

Quick assessment

Affected

Securepoint Securepoint SSL VPN Client v2

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Securepoint SSL VPN Client v2（Windows 平台）在处理 OpenVPN 配置和代理设置时存在漏洞，允许非特权本地用户影响以 NT AUTHORITY\SYSTEM 权限执行的操作。目前已识别出两种攻击途径：配置校验和更新授权不当：特权服务在更新 OpenVPN 配置的校验和时，未对连接客户端的授权进行充分验证。这使得非特权本地用户能够在无需管理员权限的情况下修改 OpenVPN 配置并设置有效的校验和。随后，该被篡改的配置将以 NT AUTHORITY\SYSTEM 权限进行处

CVSS 6.9 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1548.003 · Sudo and Sudo Caching T1548.001 · Setuid and Setgid

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Securepoint	Securepoint SSL VPN Client v2	`1.0.2< 2.0.50`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows

Source: CVE Program / CVE List V5

Vulnerability Description

Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges. Two attack vectors have been identified: * Improper authorization of configuration checksum updates: The privileged service does not properly validate the authorization of connecting clients when updating the checksum of an OpenVPN configuration. This allows a non-privileged local user to modify an OpenVPN configuration and set a valid checksum without administrator privileges. The modified configuration is subsequently processed with NT AUTHORITY\SYSTEM privileges. * Argument injection via proxy settings: The client does not properly validate or sanitize proxy settings before passing them as arguments to OpenVPN. A non-privileged local user can inject additional arguments through the proxy settings, influencing the execution of OpenVPN with NT AUTHORITY\SYSTEM privileges. This attack vector does not require direct communication with the privileged service or modification of the protected OpenVPN configuration.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

参数注入或修改

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Securepoint	Securepoint SSL VPN Client v2	1.0.2 ~ 2.0.50	-

II. Public POCs for CVE-2026-97350

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-97350

请登录查看更多情报信息。

Other References for CVE-2026-97350 (1)

https://wiki.securepoint.de/Advisory/CVE-2026-97350

https://www.cve.org/CVERecord?id=CVE-2026-97350

IV. Related Vulnerabilities

Same weakness: CWE-88