CVE-2023-37849

MediumCVSS 6.5

Published: 13/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

29th percentile - higher than 29% of all known CVEs

Summary

CVE-2023-37849 describes a DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8, allowing attackers to execute arbitrary code by placing a crafted DLL file in the same directory as PANDAVPN.exe.

Risk Assessment

This vulnerability poses a risk of arbitrary code execution, potentially leading to system compromise and data leakage.

Recommendation

It is recommended to update Panda Security VPN to version v15.14.8 or later to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as PANDAVPN.exe.