CVE-2014-5455

5.3 mediumEPSS 1.0%

Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-428
Published: 2014-08-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openvpn:openvpn
privatetunnel:privatetunnel

References

http://osvdb.org/show/osvdb/109007
http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html
http://www.exploit-db.com/exploits/34037
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php
https://github.com/CVEProject/cvelist/pull/3909

Check your stack JSON