CVE-2023-27395
📋 TL;DR
A heap-based buffer overflow in SoftEther VPN's WpcParsePacket() function allows remote attackers to execute arbitrary code via specially crafted network packets. This vulnerability affects SoftEther VPN versions 4.41-9782-beta, 5.01.9674, and 5.02. Attackers can exploit this through man-in-the-middle attacks against VPN connections.
💻 Affected Systems
- SoftEther VPN Server
📦 What is this software?
Vpn by Softether
Vpn by Softether
Vpn by Softether
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/administrator privileges, installing persistent backdoors, and pivoting to internal networks.
Likely Case
Remote code execution leading to VPN server compromise, credential theft, and network eavesdropping on VPN traffic.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls, potentially only denial of service.
🎯 Exploit Status
Exploitation requires man-in-the-middle position but no authentication. Public technical details available in Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.02.5180 or later
Vendor Advisory: https://www.softether.org/9-about/News/904-SEVPN202301
Restart Required: Yes
Instructions:
1. Download latest version from SoftEther website. 2. Stop VPN server service. 3. Install update. 4. Restart VPN server service.
🔧 Temporary Workarounds
Network Segmentation
allIsolate VPN servers from critical internal networks using firewalls
Disable Vulnerable Versions
linuxTemporarily disable SoftEther VPN until patched
sudo systemctl stop vpnserver
sudo service vpnserver stop
🧯 If You Can't Patch
- Implement strict network access controls to limit VPN server exposure
- Deploy intrusion prevention systems with CVE-2023-27395 signatures
🔍 How to Verify
Check if Vulnerable:
Check SoftEther VPN version: On Linux: vpncmd /server localhost /cmd About. On Windows: Check program version in About dialog.Check Version:
vpncmd /server localhost /cmd About | grep VersionVerify Fix Applied:
Verify version is 5.02.5180 or later using same commands📡 Detection & Monitoring
Log Indicators:
- Unusual packet parsing errors
- VPN server crashes
- Memory access violation logs
Network Indicators:
- Malformed WPC packets to VPN server port
- Unusual traffic patterns to VPN server
SIEM Query:
source="vpnserver" AND (error OR crash OR overflow)🔗 References
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735
- https://www.softether.org/9-about/News/904-SEVPN202301
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735
- https://www.softether.org/9-about/News/904-SEVPN202301
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1735
