SSLVPN Client : Missing authentication on management interface (CVE-2021-31814)

Advisory ID CVE Number Date discovered Severity Advisory revision
STORM-2021-019 CVE-2021-31814 04/15/2021 medium v1

Vulnerability details

Any user with local privileges can access OpenVPN’s managment interface. This could lead to a denial of service and information leak.

Impacted products

Stormshield Network Security medium impacted


Version Date Description
v1  02/09/2021 Initial release


Stormshield Network Security

CVSS v3.1 Overall Score: 6.8      


Impacted version

An attacker on the host could access OpenVPN’s managment interface. The interface can be used to read logs, show active connections status, or terminate VPN sessions.


  • 2.1.0 to 2.9.1

Workaround solution


There is no workaround.

The 3.0.0 update fixes this vulnerability.

Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability impact
Local Low Low None Unchanged Low None High
CVSS Base score: 6.1 CVSS Vector: (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Exploit Code Maturity Remediation Level Report Confidence
Proof of concept code Official fix Confirmed
CVSS Temporal score: 5.5 CVSS Vector: (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C)
Confidentiality Requirement Integrity Requirement Availability Requirement
High High High
CVSS Environmental score: 6.8 CVSS Vector: (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:X/MAC:X/MPR:X/MUI:X/MS:X/MC:X/MI:X/MA:X)