BaseFortify

Publication date: 2025-12-03

Last updated on: 2025-12-12

Assigner: OpenVPN Inc.

Description

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-03

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-12-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13086

Affected Vendors & Products

Vendor	Product	Version / Range
openvpn	openvpn	2.7_rc1
openvpn	openvpn	2.6.0
openvpn	openvpn	2.7_alpha1
openvpn	openvpn	2.6.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-940	The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenVPN versions 2.6.0 through 2.7_rc1 involves improper validation of source IP addresses. It allows an attacker to open a session from a different IP address than the one that initiated the connection, which can disrupt the original client's connection.

Impact Analysis

The vulnerability can result in a denial of service for the originating client by allowing an attacker to hijack or interfere with the VPN session from a different IP address.

Hi! I’m here to help you understand CVE-2025-13086. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70