CVE-2021-35523: Securepoint Openvpn-Client

High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.

Affected products

• Securepoint Openvpn-Client: from 2.0.15, before 2.0.32 (fixed in 2.0.32)

Published 2021-06-28. Last modified 2026-06-17.