CVE-2024-38520

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-38520
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38520.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-38520
Related
  • GHSA-j35p-p8pj-vqxq
Published
2024-06-26T19:15:13Z
Modified
2025-07-02T00:31:43.023628Z
Summary
[none]
Details

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it introduces the possibility of the host being used for amplification/reflection traffic generation because it will respond to every packet with two response packets that are larger than the request packet size. These sorts of techniques are used by external actors who generate spoofed source IPs to target a destination on the internet. This vulnerability has been patched in version 5.02.5185.

References

Affected packages

Git / github.com/softethervpn/softethervpn

Affected ranges

Type
GIT
Repo
https://github.com/softethervpn/softethervpn
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

5.*

5.01.9658
5.01.9659
5.01.9660
5.01.9661
5.01.9662
5.01.9663
5.01.9664
5.01.9665
5.01.9666
5.01.9667
5.01.9668
5.01.9669
5.01.9670
5.01.9671
5.01.9672
5.01.9673
5.01.9674
5.02.0
5.02.5180
5.02.5181
5.02.5182
5.02.5183
5.02.5184