Vulnerability Details CVE-2025-3908
The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 3.2%
CVSS Severity
CVSS v3 Score 6.2
References
Products affected by CVE-2025-3908
-
cpe:2.3:a:openvpn:openvpn3linux:*
-
cpe:2.3:o:linux:linux_kernel:-