Pie chart showing the types of VPN vulnerabilities in 2023
Pie chart showing the types of VPN vulnerabilities in 2022
Pie chart showing the types of VPN vulnerabilities in 2021
Code Execution and Injection Vulnerabilities
Code Execution and Injection, which is the most common category of vulnerabilities across the dataset, refers to flaws and weaknesses in software that permit attackers to run malicious or arbitrary code. This can be done either within the context of an application or within the broader scope of an underlying operating system.
Over a fifth (21%) of VPN vulnerabilities between 2021 and 2023 could be categorized as code execution and injection, making it the most common vulnerability during that period, as well as specifically in 2021 and 2023. There was a 93% year-over-year spike in this kind of vulnerability in 2023 and a 32% increase compared to the average over the previous two years.
Some of the methods utilised in vulnerabilities present in this category include Dynamic Link Libraries (DLL) Hijacking and Injection, Command Injection and SQL injection.
DLL Hijacking involves exploiting the way some applications search and load DLLs. If an attacker can trick an application into loading a malicious DLL, they can execute arbitrary code with the same privileges as the application. Command Injection involves attackers exploiting inadequate input validation mechanisms to insert or “inject” commands that the system will execute. Finally during SQL Injection malicious SQL statements are inserted into an entry field, leading to unauthorized database actions.
Many vulnerabilities stem from web interfaces used for device management, especially in VPN routers and other networking equipment, and a lack of, or inadequate, input validation. In addition to this, improper handling or validation of HTTP requests can allow for command or code injection. Execution of arbitrary code can lead to a wide range of malicious outcomes, from data breaches to device control. Some vulnerabilities can also lead to Denial of Service (DoS) conditions, where a device or service becomes unavailable.
Mitigation strategies against code execution and injection vulnerabilities include secure coding practices, rigorous input validation, regular vulnerability assessments by product vendors, as well as prompt application of software updates by the user. These practices are crucial to protect systems from being compromised by attackers exploiting such vulnerabilities.
There were 20 different vendors affected by vulnerabilities categorized as Code Execution and Injection, some of the most notable being Cisco, Zyxel and Synology. Synology was involved in the previously mentioned sole instance over the entire period with a maximum CVSS base score of 10.
Some examples of the most critical vulnerabilities in this category, all with a base score of 9.8 out of 10, include:
Zyxel Command Injection Flaw: CVE-2022-30525
In 2022, various Zyxel devices, ranging from the USG FLEX series to the VPN series, were identified with a critical OS command injection vulnerability. Specifically, firmware versions from 5.00 up to 5.21 Patch 1 were affected, allowing attackers to manipulate certain files and execute operating system commands on the compromised device.
This is another example of a Zyxel vulnerability which saw attempts of exploitation soon after its announcement. The severity of this vulnerability once again put the NHS at risk, with alerts of the affected platforms posted on the official website.[3]
Array Networks Remote Code Execution: CVE-2023-28461
In 2023 a severe remote code execution vulnerability impacted the Array AG Series and vxAG solutions (up to version 9.4.0.481) from Array Networks. Unauthorized users could exploit this flaw by using a ‘flags’ attribute in an HTTP header to browse the filesystem of the SSL VPN gateway, leading to potential system compromise. In a statement in March, Array Networks advised a fix was imminent, which was made available later that month. [4]
Milesight VPN Authentication Bypass: CVE-2023-22319
Milesight’s VPN software version 2.0.2 was found to have a SQL injection vulnerability within its LoginAuth function in 2023, allowing for an authentication bypass through a specially crafted network request. This vulnerability could enable attackers to send malicious packets to exploit the system.
Denial of Service (DoS) Attacks
The ‘Denial of Service (DoS) Attacks’ category of vulnerabilities concerns situations where attackers aim to interrupt or suspend the services of a host connected to the internet. This typically involves overwhelming a system with a flood of internet traffic, although other methods can be used. The result is that legitimate users are unable to access the system or its services.
There were 54 instances of DoS based vulnerabilities affecting VPNs between 2021 and 2023. It was the most common type of VPN vulnerability in 2022. Nevertheless, there was a 60% increase in this type of vulnerability recorded in 2023 than there was on average over the previous two years, the highest increase across the top five categories.
Methods seen in vulnerabilities throughout this category include using specially designed packets or requests that the system cannot handle appropriately, overloading system resources, such as memory, which can render a system unresponsive, or inputting incorrect or unexpected data values causing crashes or unanticipated behaviors. Vulnerabilities in this category stem from issues of prioritizing and managing network traffic, a lack of proper input validation and inaccurate or incomplete handling of specific network protocols.
Mitigation strategies to safeguard against Denial of Service (DoS) attacks involve implementing a network architecture which can distribute traffic evenly and prevent system overload, employing rate limiting, and configuring firewalls and routers to reject any suspicious requests.
There were 14 different vendors affected by this type of vulnerability, including Cisco, OpenVPN and SoftEther VPN. The average CVSS base score of this category was 7.2, classifying it as being of a high severity.
Some of the most severe vulnerabilities in this category include:
Cisco Small Business Router Vulnerabilities: CVE-2021-1610
In 2021, Cisco’s Small Business RV Series routers were found to be susceptible to multiple severe vulnerabilities, enabling attackers to execute arbitrary code, cause a denial of service (DoS), or execute arbitrary commands. Specifically, the RV340, RV340W, RV345, and RV345P models were affected. The vulnerabilities had a base score of 9.8 out of 10, indicating a significant risk over the network, with potential serious consequences for confidentiality.
Cisco NX-OS Software DoS Issue: CVE-2021-1587
Another 2021 vulnerability in Cisco’s repertoire, rated with a base score of 8.6, was discovered in the NX-OS Software, affecting devices part of a VXLAN EVPN fabric with the NGOAM feature enabled. This issue, due to the mishandling of specific packets, could allow an unauthenticated attacker to trigger high CPU usage and system resource depletion, leading to control plane instability and potential device restarts.
Moby Project Packet Injection Flaw: CVE-2023-28840
In 2023, a notable vulnerability was identified within the Moby Project, specifically within its Docker component. A weakness was found in the iptables rules setup for encrypted overlay networks, which could permit denial of service attacks or arbitrary data injection. This flaw had broad implications for Docker and its downstream products, prompting releases of patched versions to address the security gap. This vulnerability scored an 8.7 base score, marking it as a high-risk concern for networked environments.
Privilege Escalation Vulnerabilities
Privilege escalation vulnerabilities, which were the third most common category over the period, allow a user to gain elevated access to resources that are normally protected from an application or user. This could enable the attacker to take control of the affected system.
There were 39 instances of vulnerabilities in this category affecting VPNs during the last three years, the majority of which occurred in 2022 and 2021. This was the only category in the top five which did not experience an increase in 2023 compared to the two years prior.
Some of the common vulnerabilities in this category include exploitation of unquoted service paths, placing malicious files in directories, exploiting the loading of Dynamic Link Libraries (DLLs) to run arbitrary code, and exploiting weak or misconfigured permissions.
Many vulnerabilities are linked to services or daemons that run with high privileges. Some other points of exploitation include installers and configuration files which may contain insecure default settings or paths, or vulnerabilities within VPN settings, which could provide attackers significant system access.
This type of vulnerability affected 21 vendors, including Cisco and Zyxel, along with cybersecurity company Fortinet. The category had a base score of 7.7 making it the second more severe category out of the top five categories discussed in this research.
Proper user management, avoiding over-permissive settings, and following best practices in software design and system administration are crucial defenses against privilege escalation threats.
Examples of the most severe vulnerabilities in this category, all identified in 2022, include:
Netgear SQL Injection Flaw: CVE-2022-29383
A SQL injection vulnerability was found in the NETGEAR ProSafe SSL VPN firmware for models FVS336Gv2 and FVS336Gv3, where the USERDBDomains.Domainname
parameter in cgi-bin/platform.cgi
was improperly handled. This flaw could lead to privilege escalation and had a high severity with a base score of 9.8.
Android VPN Credential Leak: CVE-2022-20145
A vulnerability within Android’s Vpn.java
file for Android-11 was disclosed, where a protocol downgrade attack could allow attackers to retrieve VPN credentials remotely. This could result in an escalation of privilege without the need for user interaction or additional execution privileges, especially when connected to a malicious Wi-Fi AP. The issue was critical, with a network attack vector and a base score of 9.8.
Fortinet FortiClient Privilege Escalation: CVE-2021-44169
Fortinet’s FortiClient for Windows (versions 6.0.10 and below, 6.2.9 and below, 6.4.7 and below, 7.0.3 and below) exhibited a vulnerability due to improper initialization, which could allow an attacker to gain administrative privileges by placing a malicious executable in the installer’s directory. This logic flaw had an 8.8 base score, which, while lower than the previous two examples, was combined with a maximum confidentiality score of 6.
Information Disclosure and Data Leaks
Information Disclosure and Data Leaks, which is the fourth most common type of VPN vulnerability we found, includes vulnerabilities where unauthorized individuals can access or retrieve sensitive or proprietary information that should be restricted. Such unauthorized access can lead to a breach of privacy, a compromise of system integrity, and even potential misuse of the disclosed information.
There were 35 instances of Information Disclosure and Data Leaks vulnerabilities affecting VPNs between 2021 and 2023. Reports of this type of vulnerability increased by 30% in 2023 compared to 2021 and 18% against the two-year average.
There were 24 different vendors affected by this type of vulnerability, the highest number affected by a single category. Affected vendors included Fortinet, McAfee and SoftEther VPN.
Some common types of vulnerabilities in this category include unauthorized users accessing or reading files they shouldn’t be able to, often due to misconfigurations or design flaws, sending data over the network without proper encryption, which can lead to information interception, and systems not sufficiently encrypting or masking sensitive data, making it easily accessible.
Information Disclosure and Data Leaks vulnerabilities can occur due to a variety of reasons, such as leaked session IDs or tokens, which can allow unauthorized users to hijack sessions, configuration files, which have not been properly secured, containing sensitive details and systems that don’t adequately sanitize logs or histories, which can inadvertently store sensitive data.
To prevent information disclosure and data leaks, it’s essential to enforce strict access control, utilize strong encryption, and maintain rigorous data handling protocols. Ensuring users have only necessary data access, encrypting stored and transmitted data, securing system configurations, and sanitizing logs can significantly reduce leak risks. Regular audits and timely patching of vulnerabilities are also crucial to safeguard sensitive information.
The average base score for this category was 6.6, which is the lowest average base score out of the top five most prevalent categories, being only classified as having Medium Severity on the CVSS scale. Nevertheless, the potential consequences of data leaks, particularly in today’s data-driven world, are a significant concern and addressing these vulnerabilities is paramount for businesses and individuals alike.
The most significant vulnerabilities in this category, all with a base score of 9.8 out of 10 include:
Snapdragon Certificate Validation Flaw: CVE-2020-11176
In 2021, a memory corruption vulnerability was discovered in the IPSec server across multiple Snapdragon platforms, including Auto, Compute, and various IoT devices. Specifically, the flaw arose from improper heap allocation during the processing of server certificates, which could lead to memory corruption.
OpenVPN Netfilter Flaw: CVE-2021-3773
A serious vulnerability in OpenVPN’s Netfilter, identified in 2021, allowed network-connected attackers to infer connection endpoint information, potentially paving the way for further traditional network attacks.
Ruijie Networks Remote Code Execution: CVE-2023-34644
In 2023, Ruijie Networks’ RG-EW series, among other devices, was found to have a remote code execution vulnerability. Attackers could exploit this by sending a crafted POST request to achieve the highest privileges.
Authentication and Authorization Issues
Authentication and authorization vulnerabilities, the fifth most common category of VPN vulnerabilities seen over the past three years, arise when there are defects or weaknesses in the process of verifying the identity of a user or granting the appropriate permissions to a user.
There have been 31 instances of authentication and authorization VPN vulnerabilities since 2021. While there was only a 18% year-on-year increase in 2023, there was a 86% increase compared to 2021. The 44% increase in this kind of VPN vulnerability in 2023 compared to the average over the previous two years is the second biggest among the top five most common categories in this report.
Common vulnerabilities found within this category include weaknesses in external software or plugins that allow access with partially correct or no credentials, crafted network requests, that allow unauthorized actions by sending manipulated network requests, misconfigured services bound to wrong configurations, exposing them to external threats, as well as Man-in-the-Middle attacks, where attackers intercept and manipulate communication between parties, leading to unauthorized access or data interception.
Points of exploitation related to this category include API endpoints, where attackers may exploit vulnerabilities in the application programming interfaces, servers with specific configurations that might be more vulnerable, and web interfaces like VPN portals or web servers that may be more exposed to these types of vulnerabilities.
Implementing multi-layered security, timely patching, and avoiding hardcoded or weak credentials are fundamental to mitigating the risks associated with these issues.
There were 12 vendors affected by this type of vulnerability, including SoftEther VPN, OpenVPN and Stormshield. The category had an average base score of 7.2, classifying it as having a High severity.
Some of the most significant vulnerabilities in this category, all with a base score of 9.8 out of 10 include:
Milesight VPN Authentication Flaw: CVE-2023-22844
The Milesight VPN version 2.0.2 was found to have an authentication bypass vulnerability within its verifyToken function, as reported in 2023. Attackers could exploit this by sending a specially-crafted network request, potentially granting unauthorized access.
Cisco Small Business VPN Bypass Issue: CVE-2022-20923
In 2022 Cisco’s Small Business RV Series routers were discovered to have a significant flaw in their IPSec VPN Server authentication process, allowing attackers to bypass authentication controls remotely. The vulnerability stemmed from improper password validation algorithm implementation.
Following the publication of this vulnerability, Cisco announced the authentication bypass flaw would not be patched as the affected devices have reached end-of-life. The company instead advised affected users to migrate to Cisco Small Business RV132W, RV160, or RV160W Routers.
Zyxel Firewall Authentication Bypass: CVE-2022-0342
Also in 2022, a broad range of Zyxel devices was susceptible to an authentication bypass in their firmware, affecting models from the USG/ZyWALL, USG FLEX, ATP, VPN, and NSG series. The flaw allowed attackers to circumvent web authentication and gain administrative device access.