CVE-2014-5455
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel...
CVE-2014-5455 is a medium vulnerability (CVSS 6.9) in Openvpn, published August 25, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. No source names a fixed version.
- Severity
- 6.9 MediumCVSS 2.0, NVD
- Exploit chance
- 0.95%EPSS, 61st percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OpenVPN Private Tunnel Core Service - Unquoted Service Path Privilege Escalation | 2014-07-12 |
What each source reports
CVE List
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
- Record
CVE-2014-5455- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-428
- Updated
- 2026-11-02
EUVDEUVD-2014-5342
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
- Record
EUVD-2014-5342- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mww5-q78w-ffpv
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel...
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
- Record
GHSA-mww5-q78w-ffpv- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-428
- Updated
- 2026-11-02
NVD
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
- Record
CVE-2014-5455- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-428
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exploit-db.com/exploits/34037
zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php
packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html
h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943
osvdb.org/show/osvdb/109007
github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d
nvd.nist.gov/vuln/detail/CVE-2014-5455