# CVE-2023-7235: OpenVPN 2.x GUI Privilege Escalation Possible if Installed Outside Default Installation Path on Windows
+
# CVE-2023-7235: OpenVPN 2.x GUI privilege escalation possible if installed outside default installation path on Windows
-
When OpenVPN 2 GUI is installed on Windows in a non-standard installation directory, the installation directory's access control is not properly restricted. Windows, by default, assigns very open permissions, making any directory outside of standard system paths writable to anyone. This vulnerability allows an attacker to replace the OpenVPN service component with malicious code, gaining increased control over the host when the OpenVPN service process is restarted.
+
When installing OpenVPN 2 GUI on Windows using a non-standard installation directory, the installation directory will not be properly restricted via access control. Due to Windows defaulting to very open permissions by default, any user on this directory outside of standard system paths will be writable to anyone. This enables an attacker to replace the OpenVPN service component with some other code allowing the attacker to get more control over the host next time the OpenVPN service process is restarted.
