CVE-2021-44466

7.3 highEPSS 0.4%

High (7.3) in leap bitmask riseup vpn. EPSS 0.4% chance of exploitation in the next 30 days.

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN executable with a malicious one. When a higher privileged user such as an Administrator launches that executable, it is possible for the lower privileged user to escalate to Administrator privileges.

Severity

CVSS 3.1

7.3 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2021-12-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

leap:bitmask_riseup_vpn

References

https://www.tenable.com/security/research/tra-2021-58
https://www.tenable.com/security/research/tra-2021-58

Check your stack JSON