CVE-2020-27518: 
Windscribe vulnerability analysis and mitigation

All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in the WindscribeService. The vulnerability was discovered and responsibly disclosed in September 2020 (Security Advisory).

The vulnerability exists in the way Windscribe handles custom OpenVPN configuration files. The OpenVPN executable packaged with Windscribe runs as SYSTEM privileges and allows users to specify custom OpenVPN config files. A malicious user could exploit this by creating a malicious configuration file that executes arbitrary code with SYSTEM privileges through the script-security and up directives (Security Advisory).

If successfully exploited, this vulnerability allows an authenticated local attacker to elevate their privileges to SYSTEM level on Windows systems, effectively gaining complete control over the affected system (Security Advisory).

The vulnerability can be exploited by a local user with access to the Windscribe VPN application by creating a malicious OpenVPN configuration file that includes script execution commands (Security Advisory).

Users should update their Windscribe VPN client to a version newer than v2.02.10 which contains fixes for this vulnerability (Security Advisory).