CVE-2018-10204

PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" service. When configured to use the OpenVPN protocol, the "sevpnclient" service executes "openvpn.exe" using the OpenVPN config file located at %PROGRAMDATA%\purevpn\config\config.ovpn. This file allows "Write" permissions to users in the "Everyone" group. An authenticated attacker may modify this file to specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM account.

• CWE-732

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-021.mdThird Party Advisory
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-021.mdThird Party Advisory

Published

Apr 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10196NULL pointer dereference vulnerability in the rebuild_vlists…
• CVE-2018-10197There is a time-based blind SQL injection vulnerability in t…
• CVE-2018-10198An issue was discovered in OTRS 6.0.x before 6.0.7. An attac…
• CVE-2018-10199In versions of mruby up to and including 1.4.0, a use-after-…
• CVE-2018-1020A remote code execution vulnerability exists when Internet E…
• CVE-2018-10201An issue was discovered in NcMonitorServer.exe in NC Monitor…
• CVE-2018-10205hyperstart 1.0.0 in HyperHQ Hyper has memory leaks in the co…
• CVE-2018-10206An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10207An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10208An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10209An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-1021An information disclosure vulnerability exists when Microsof…