{"cve":"CVE-2017-17809","nvd":{"published":"2017-12-20T23:29:00.453","modified":"2026-06-17T01:11:41.387","status":"Modified","description":"In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forcing the VyprVPN application to load a malicious dynamic library every time a new connection is made.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-426"],"references":["https://github.com/VerSprite/research/blob/master/advisories/VS-2017-007.md","https://github.com/VerSprite/research/blob/master/advisories/VS-2017-007.md"],"products":["goldenfrog:vyprvpn"],"source":"nvd","synced_at":"2026-10-19T20:47:56.471723566+00:00"},"epss":{"cve":"CVE-2017-17809","score":0.00796,"percentile":0.56458,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}