CVE-2020-12828: Pango Virtual Private Network Software Development Kit

Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days.

An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges.

Affected products

• Pango Virtual Private Network Software Development Kit: before 1.3.3.218 (fixed in 1.3.3.218)

Published 2020-05-21. Last modified 2026-06-17.