An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability.
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vpn | Softether | 4.41-9782-beta (including) | 4.41-9782-beta (including) |
| Vpn | Softether | 5.01.9674 (including) | 5.01.9674 (including) |