The vulnerability arises from a flaw in the handling of EAP‑TLS packets in SoftEther VPN Developer Edition 5.2.5188 and earlier. A single malformed EAP‑TLS packet received over the L2TP protocol can trigger a crash of the vpnserver process, immediately terminating all active VPN sessions. The defect is a resource denial weakness, under CWE‑789, and results in a denial‑of‑service condition that disrupts connectivity for all users connected to the affected server.

Affected products are SoftEtherVPN Server, specifically the Developer Edition version 5.2.5188 and earlier releases. The issue affects deployments that enable L2TP over UDP on port 1701 and do not restrict unauthenticated EAP‑TLS traffic. No other SoftEther product versions or branches are listed as impacted.

The CVSS v3.1 score of 7.5 indicates a high severity risk, while the EPSS score of less than 1% suggests a low likelihood of current exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying it may not yet have been observed in widespread attacks. An attacker can reach the target remotely from any network that can reach port 1701; no local access or elevated privileges are required. Successful exploitation would cause an abrupt service halt, impacting availability for all client connections.