SaferVPN Windows Local Privilege Escalation Vulnerability Threat Intel Advisory

CloudSEK threat intelligence advisory on SaferVPN local privilege escalation vulnerability tracked as CVE-2020-26050 affects Windows systems

Updated on

July 16, 2025

Published on

January 19, 2021

Read MINUTES

Subscribe to the latest industry news, threats and resources.

Table of Contents

This is also a heading
This is a heading

Advisory	Vulnerability Intelligence
CVE	CVE-2020-26050/Local Privilege Escalation
Application/Platform	SaferVPN/Windows

The vulnerability discovered in SaferVPN Windows app, tracked as CVE-2020-26050, allows local privilege escalation on the Windows system. This is due to the execution of an associated binary in the context of NT AUTHORITY\SYSTEM, which is the highest privilege on Windows systems. The SaferVPN application spawns openvpn.exe binary while connecting to a VPN server. The binary, then, runs in the context of NT AUTHORITY\SYSTEM and loads an openssl configuration file (openssl.cnf) from a non-existing folder in the C:\ directory. This can be abused by threat actors, whereby they replace the configuration file with a malicious one. Since the configuration file is run by NT AUTHORITY\SYSTEM, the attacker will get full control over the target system.

Affected Versions

SaferVPN 5.0.3.3 to 5.0.4.15 (Latest release)

Configuration Directory

C:\etc\ssl\openssl.cnf

Impact

Attackers can escalate the privilege from a normal user to the system, thereby gaining full control over the target.
High privilege can be abused by the attacker to make system level changes to further the attack.
Attackers can disable critical security services on the system by abusing the system privilege.

Mitigation

SaferVPN has not released a patch for this vulnerability, yet.

CloudSEK Platform is a no-code platform that powers our products with predictive threat analytic capabilities.

Table of Contents

This is also a heading
This is a heading

Recent Articles

Cowin data leak claim and CloudSEK analysis

June 12, 2023

Anonymous Sudan Claims Successful Takedown of First Abu Dhabi Bank Website & Application Via DDoS Attacks

May 29, 2023

Get Global Threat Intelligence on Real Time

Protect your business from cyber threats with real-time global threat intelligence data.. 30-day free and No Commitment Trial.

جدولة عرض تجريبي

Real time Threat Intelligence Data

More information and context about Underground Chatter

On-Demand Research Services

Global Threat Intelligence Feed

Protect and proceed with Actionable Intelligence

The Global Cyber Threat Intelligence Feed is an innovative platform that gathers information from various sources to help businesses and organizations stay ahead of potential cyber-attacks. This feed provides real-time updates on cyber threats, including malware, phishing scams, and other forms of cybercrime.

Trusted by 400+ Top organisations

Get started

Learn more

Advisory

CVE

Application/Platform

Protect and proceed with Actionable Intelligence