All Roads Lead to OpenVPN: Pwning Industrial Remote Access Clients

Claroty Team82 analyzed VPN client products that embed OpenVPN and uncovered a class of vulnerabilities where an unauthenticated local management interface combined with browser-origin blind SSRF allows an attacker to force the client to load attacker-hosted OpenVPN configuration files (including SMB/UNC paths) that use OpenVPN script directives (e.g., "up") to execute arbitrary commands as SYSTEM; the report provides PoC details, affected vendors and CVEs, and mitigation guidance.