CVE-2013-2061: The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows rem...

Security readout for executives and security teams

CVE-2013-2061 affects OpenVPN 2.3.0 and earlier in UDP mode. A remote attacker may be able to recover sensitive information by measuring cryptographic timing behavior and abusing CBC padding behavior. This is most relevant to old OpenVPN deployments that still use affected code and CBC-mode configurations. Exposure is likely limited to legacy OpenVPN 2.3.0 or earlier deployments, especially UDP-based services using CBC-mode ciphers. Modern patched packages should not be assumed affected without version and configuration evidence. Treat this as a legacy VPN risk that deserves prompt remediation where old OpenVPN remains deployed. It is not KEV-listed in the bundle, but VPN confidentiality impact makes exposed, unpatched systems business-relevant. Mitigation focus: Inventory all OpenVPN servers and clients for versions 2.3.0 or earlier.; Apply OpenVPN or distribution vendor updates addressing CVE-2013-2061.; Prioritize internet-facing UDP OpenVPN services using CBC-mode configurations..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.