Cve 2025 25567

Summary

SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function.

To exploit the vulnerability, an attacker must utilize the vpncmd binary file and provide an input of 137 bytes to cause a buffer overflow condition, which will allow for control of the instruction pointer.

Details

A stack-based overflow exists in the Internat.c files from lines 2458 to lines 2503, as seen below. The tmp variable of UnitoInt is overflowed at an offset of 160.

// Convert a string to an integer
UINT UniToInt(wchar_t *str)
{
	char tmp[128];
	// Validate arguments
	if (str == NULL)
	{
		return 0;
	}

	UniToStrForSingleChars(tmp, sizeof(tmp), str);

	return ToInti(tmp);
}

// Convert only single-byte characters in the Unicode string to a char string
void UniToStrForSingleChars(char *dst, UINT dst_size, wchar_t *src)
{
	UINT i;
	// Validate arguments
	if (dst == NULL || src == NULL)
	{
		return;
	}

	for (i = 0;i < UniStrLen(src) + 1;i++)
	{
		wchar_t s = src[i];
		char d;

		if (s == 0)
		{
			d = 0;
		}
		else if (s <= 0xff)
		{
			d = (char)s;
		}
		else
		{
			d = ' ';
		}

		dst[i] = d;
	}
}