CVE-2023-27395: Softether VPN

High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days.

A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

Affected products

• Softether VPN: version 4.41-9782 only; version 5.01.9674 only; version 5.02 only

Published 2023-10-12. Last modified 2026-06-17.