CVE-2025-13751

Severity Score

1.3

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Interactive service agent in OpenVPN version 2.5.0 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

Low

User Interaction

Passive

System

Vulnerable | Subsequent

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

Low

User Interaction

Passive

System

Vulnerable | Subsequent

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2025-11-26 CVE Reserved
2025-12-03 CVE Published
2025-12-03 CVE Updated
---------- EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-770: Allocation of Resources Without Limits or Throttling
CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime
CWE-841: Improper Enforcement of Behavioral Workflow

CAPEC

References (3)

URL	Tag	Source
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00153.html	Release Notes
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00154.html	Release Notes

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://community.openvpn.net/Security%20Announcements/CVE-2025-13751	2025-12-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
OpenVPN Search vendor "OpenVPN"		OpenVPN Search vendor "OpenVPN" for product "OpenVPN"				>= 2.5.0 <= 2.7_rc2 Search vendor "OpenVPN" for product "OpenVPN" and version " >= 2.5.0 <= 2.7_rc2"		en		Affected