{"id":"CVE-2019-11868","aliases":["EUVD-2019-3528","GHSA-fvwg-j6fx-cf57"],"status":"published","title":"See.sys through 4.25 in the SoftEther VPN Server allows a user to specify any kernel address to...","description":"See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00354,"percentile":0.29562,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2019-07-29T16:28:32Z","modified":"2026-06-17T02:13:46Z","products":[{"vendor":"softether","product":"see.sys"}],"references":[{"url":"https://github.com/SoftEtherVPN/SoftEtherVPN/tree/master/src/See","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://downwithup.github.io/CVEPosts","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.softether.org/9-about/News/900-SEVPN201901","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11868"},{"url":"https://github.com/advisories/GHSA-fvwg-j6fx-cf57"}],"sources":{"cve":[{"id":"CVE-2019-11868","description":"See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to.","status":"published","published":"2019-07-29T16:28:32Z","modified":"2024-08-04T23:03:32.813Z","updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2019-3528","description":"See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to.","status":"published","published":"2019-07-29T16:28:32Z","modified":"2024-08-04T23:03:32Z","updated_at":"2026-11-03T02:40:47.960625Z"}],"ghsa":[{"id":"GHSA-fvwg-j6fx-cf57","title":"See.sys through 4.25 in the SoftEther VPN Server allows a user to specify any kernel address to...","description":"See.sys through 4.25 in the SoftEther VPN Server allows a user to specify any kernel address to which arbitrary bytes are written.","status":"published","published":"2022-05-24T16:51:38Z","modified":"2024-04-04T01:25:16Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:55:58.413912Z"}],"nvd":[{"id":"CVE-2019-11868","description":"See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to.","status":"published","published":"2019-07-29T17:15:11.387Z","modified":"2026-06-17T02:13:46.3Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:21.892729Z"}]}}