CVE-2023-22308
📋 TL;DR
An integer underflow vulnerability in SoftEther VPN's vpnserver OvsProcessData functionality allows attackers to cause denial of service by sending specially crafted network packets. This affects SoftEther VPN servers running vulnerable versions, potentially disrupting VPN connectivity for all users.
💻 Affected Systems
- SoftEther VPN Server
📦 What is this software?
Vpn by Softether
Vpn by Softether
⚠️ Risk & Real-World Impact
Worst Case
Complete VPN service disruption, preventing all remote access and network connectivity through the VPN server.
Likely Case
Service crash requiring manual restart of the vpnserver process, causing temporary VPN outage.
If Mitigated
Minimal impact if patched or network controls prevent malicious packets from reaching the VPN server.
🎯 Exploit Status
Exploitation requires sending a crafted network packet to the VPN server port.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.02.5180 or later
Vendor Advisory: https://github.com/SoftEtherVPN/SoftEtherVPN_Stable/releases
Restart Required: Yes
Instructions:
1. Download latest version from SoftEther VPN website. 2. Stop vpnserver service. 3. Backup configuration. 4. Install updated version. 5. Restart vpnserver service.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to VPN server ports to trusted IP addresses only.
iptables -A INPUT -p tcp --dport 443,992,1194,5555 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443,992,1194,5555 -j DROP
Service Monitoring and Auto-restart
linuxConfigure monitoring to automatically restart vpnserver if it crashes.
systemctl enable vpnserver
systemctl start vpnserver
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to VPN server
- Deploy intrusion detection/prevention systems to detect and block malicious packets
🔍 How to Verify
Check if Vulnerable:
Check SoftEther VPN version: vpncmd localhost /SERVER /CMD AboutCheck Version:
vpncmd localhost /SERVER /CMD About | grep VersionVerify Fix Applied:
Verify version is 5.02.5180 or later using same command📡 Detection & Monitoring
Log Indicators:
- vpnserver process crashes
- unexpected service restarts
- abnormal packet size in logs
Network Indicators:
- Malformed packets to VPN server ports (443, 992, 1194, 5555)
- Sudden drop in VPN connections
SIEM Query:
source="vpnserver.log" AND ("crash" OR "segmentation fault" OR "abnormal packet")