CVE-2023-37849

A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as PANDAVPN.exe.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.40% chance of exploitation in the next 30 days, 34th percentile

Published

2023-07-13

Updated

2024-10-30

Proof-of-concept exploits (1)

• https://heegong.github.io/posts/Local-privilege-escalation-in-Panda-Dome-VPN-for-Windows-…

References

• CVE Record
• NVD entry

Related

• CVE-2023-3784
• CVE-2023-3785
• CVE-2023-37837
• CVE-2023-3786
• CVE-2023-37836
• CVE-2023-3787