CVE-2008-3459

Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows...

7.6 HighFix available

Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters.

Exploit likelihood

2.12%Up 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 7.6

Record: CVE-2008-3459
CVSS 2.0: 7.6 HighAV:N/AC:H/Au:N/C:C/I:C/A:C
Weakness: CWE-16
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-3459
Updated: 2026-11-02

EUVDEUVD-2008-3445 No score

Record: EUVD-2008-3445
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w779-ggw7-rxjh No score

Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows...

Record: GHSA-w779-ggw7-rxjh
Updated: 2026-11-02

OSV No score

Record: CVE-2008-3459
Updated: 2026-11-02

OSVDEBIAN-CVE-2008-3459 No score

Record: DEBIAN-CVE-2008-3459
Updated: 2026-11-02

Affected products

openvpn

Affected packages

Affected packages
Package	Affected	Fixed
`openvpn` Debian:12	before 2.1~rc9-1	2.1~rc9-1
`openvpn` Debian:13	before 2.1~rc9-1	2.1~rc9-1
`openvpn` Debian:14	before 2.1~rc9-1	2.1~rc9-1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-3459 is a high vulnerability (CVSS 7.6) in Openvpn, published August 4, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. Fixed in openvpn 2.1~rc9-1.