CVE-2025-25567

SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function

Critical · published March 12, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

🔥 A buffer overflow in SoftEther VPN could let a local user create an attack situation against themselves through the UI! Think of it like a restaurant that accidentally gave customers the recipe for a dangerous dish without any warnings. If they mix the wrong ingredients, they could seriously hurt themselves, all while believing they were just having dinner! This flaw could allow an attacker to exploit their own system, leading to instability or crashes. While the supplier disputes the severity because it only affects local users, the potential for self-inflicted chaos is still alarming. We all know how one wrong move can lead to a catastrophic dinner party!

Put simply

Think of it like a restaurant that accidentally gave customers the recipe for a dangerous dish without any warnings. If they mix the wrong ingredients, they could seriously hurt themselves, all while believing they were just having dinner! The vulnerability in SoftEther VPN 5.02.5187 is caused by a buffer overflow in the UniToStrForSingleChars function within the Internat.c file. This flaw allows for risky overwrites of memory space, potentially destabilizing the application when manipulated.

What to do

This flaw could allow an attacker to exploit their own system, leading to instability or crashes. While the supplier disputes the severity because it only affects local users, the potential for self-inflicted chaos is still alarming. We all know how one wrong move can lead to a catastrophic dinner party! To address this vulnerability, patch to the latest version of SoftEther VPN as soon as possible. Additionally, educate users on safe practices when interacting with the UI and limit access to trusted personnel only. Always stay updated with the supplier’s advice! You've got this! By taking these steps, you'll be one step closer to securing your VPN environment! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00598 · 47.9th percentile
Published
2025-03-12T00:00Z
EPSS history
Timeline
  • 12 MAR 00:00Z
    SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function
    cvelistv5