The vulnerability arises from improper handling of OpenVPN configuration updates and proxy settings in Securepoint SSL VPN Client v2 for Windows. A local user without administrative rights can modify an OpenVPN configuration, set a valid checksum, or inject arguments via proxy settings. Both actions are then processed by the privileged service running as NT AUTHORITY\SYSTEM, allowing the attacker to execute code or commands with system privileges. This flaw embodies improper authorization and inadequate input validation, leading to a local privilege escalation that threatens the confidentiality, integrity, and availability of the entire system.

Affected installations are all Securepoint SSL VPN Client v2 for Windows on which the described flaw could be exercised. The product version numbering is referred to as v2; the vendor recommends upgrading to 2.0.50 or newer, which contains the fix. No specific sub‑versions are listed beyond that; therefore any v2 build should be considered vulnerable until the listed patch is applied.

The CVSS score of 6.9 places this vulnerability in the medium severity range. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating lower exploitation probability in the wild. However, because the attack vector requires only local user access and does not depend on network communication, the barrier to exploitation remains low for any system with an unprivileged user that can write configuration files or proxy settings. Prompt application of the official upgrade is therefore strongly advised.