CVE-2018-10169 describes a critical SYSTEM privilege escalation vulnerability in ProtonVPN 1.3.3 for Windows. The ProtonVPN Service exposes a NetNamedPipe endpoint, allowing arbitrary applications to call methods, specifically the "Connect" method. This method can be manipulated to inject a dynamic library plugin into the OpenVPN command line, executing attacker-controlled code with SYSTEM privileges. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk with a network attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 79/100. While not listed in CISA's KEV catalog, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one mention and one article discussing patches for the flaw.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.3.3CPE matchmatch criteria | cpe:2.3:a:protonmail:protonvpn:1.3.3:*:*:*:*:windows:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.