CVE-2018-10645

Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. The "SetProperty" method allows an attacker to configure the "AdditionalOpenVpnParameters" property and control the OpenVPN command line. Using the OpenVPN "plugin" parameter, an attacker may specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user. This attack may be conducted using "VyprVPN Free" account credentials and the VyprVPN Desktop Client.

• CWE-732

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-025.mdThird Party Advisory
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-025.mdThird Party Advisory

Published

May 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10635In Universal Robots Robot Controllers Version CB 3.1, SW Ver…
• CVE-2018-10636CNCSoft Version 1.00.83 and prior with ScreenEditor Version …8.8
• CVE-2018-10637A maliciously crafted project file may cause a buffer overfl…
• CVE-2018-1064libvirt version before 4.2.0-rc1 is vulnerable to a resource…
• CVE-2018-10641D-Link DIR-601 A1 1.02NA devices do not require the old pass…
• CVE-2018-10642Command injection vulnerability in Combodo iTop 2.4.1 allows…
• CVE-2018-10646CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM priv…
• CVE-2018-10647SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege e…
• CVE-2018-10648There are Unauthenticated File Upload Vulnerabilities in Cit…
• CVE-2018-10649There is a Cross-Site Scripting Vulnerability in Citrix XenM…
• CVE-2018-1065The netfilter subsystem in the Linux kernel through 4.15.7 m…
• CVE-2018-10650There is an Insufficient Path Validation Vulnerability in Ci…