Severity: Critical (CVSS 9.8)
Affected: Enterprise VPN Client versions prior to 7.4.2
Status: Patched — update immediately
Technical Overview
The vulnerability exists in the XML parsing component of the VPN client authentication handler. A specially crafted authentication packet can trigger a stack-based buffer overflow, allowing unauthenticated remote code execution as SYSTEM on Windows or root on Linux.
Recommended Actions
1. Update to version 7.4.2 or later immediately.
2. If patching is not immediately possible, restrict VPN client management interface to internal networks only.
3. Monitor for anomalous authentication events in your SIEM.