Security readout for executives and security teams
Plain-English summary
CyberGhost 6.5.0.3180 for Windows exposes a service pathway that can let a local application run code as SYSTEM. That means a compromised user account or malicious installed app could potentially gain full control of the Windows host where this version is installed.
Executive priority
Treat as high priority if this CyberGhost version exists in the estate. It can turn a local foothold into full Windows system control, but urgency depends on confirmed deployment because sources name only one old version.
Technical view
The CG6Service service exposes a NetNamedPipe endpoint with public methods. The ConnectToVpnServer method accepts connection parameters that influence the OpenVPN command line, including a dynamic library plugin executed during VPN connection attempts in the SYSTEM context.
Likely exposure
Exposure is limited to Windows systems running CyberGhost 6.5.0.3180. The bundle does not establish broader affected versions or supported patched versions.
Exploitation context
The sources do not report known active exploitation or CISA KEV listing. The issue appears to require local application access on an affected Windows host, making it most relevant for post-compromise privilege escalation.
Researcher notes
Evidence is strong for the reported mechanism but incomplete for CVSS, CWE, affected-version range, patch status, and exploitation in the wild. Avoid assuming impact beyond CyberGhost 6.5.0.3180 for Windows without vendor confirmation.
Mitigation direction
- Inventory Windows endpoints for CyberGhost 6.5.0.3180.
- Check CyberGhost or vendor guidance for fixed builds or removal advice.
- Remove the vulnerable version where business use is not required.
- Restrict local software installation rights on endpoints.
- Monitor VPN service behavior for suspicious child processes or plugin use.
Validation and detection
- Confirm whether CG6Service exists on Windows endpoints.
- Verify installed CyberGhost version equals 6.5.0.3180.
- Review endpoint telemetry for unusual activity tied to VPN connection attempts.
- Check whether vendor guidance identifies a remediated version.
- Prioritize validation on shared workstations and high-privilege user endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Privilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-10646 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/VerSprite/research/blob/master/advisories/VS-2018-023.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.