CVE-2024-53588

High

Published: 23/01/2025(UTC)Translated: 08/06/2026(UTC)NVD NIST

Summary

A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\Downloader\vpn6.

Risk Assessment

This vulnerability could lead to remote code execution, posing a significant threat to the security of the organization's systems.

Recommendation

It is recommended to update iTop VPN to the latest version and to monitor and secure paths where DLL files may be placed.

Other vulnerabilities in iTop VPN v16.0

CVE-2022-24141Medium
A vulnerability in iTop VPN 3.2 allows an attacker to steal another user's token by creating a named pipe with the same name used by the iTopVPNmini.exe component. The attacker listens for connections and abuses the ImpersonateNamedPipeClient() function.

Original NVD description (English source)

A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\Downloader\vpn6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS