CVE-2024-37391: 
Homebrew vulnerability analysis and mitigation

ProtonVPN before version 3.2.10 on Windows contains a vulnerability related to improper handling of the drive installer path. The issue was discovered and disclosed in July 2024, affecting Windows installations of ProtonVPN prior to version 3.2.10 (NVD).

The vulnerability stems from the mishandling of the drive installer path in the Setup/setup.iss file. The correct implementation should use the path format: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"'. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially allow an attacker with local access and low privileges to achieve high levels of confidentiality, integrity, and availability impacts on the affected system (NVD).

The vulnerability requires local access with low privileges and no user interaction for exploitation. The attack complexity is considered low, making it relatively straightforward to exploit if an attacker has the necessary local access (NVD).

The vulnerability has been patched in ProtonVPN version 3.2.10. Users are advised to upgrade to this version or later to mitigate the vulnerability. The fix involves correcting the drive installer path implementation in the setup configuration (ProtonVPN Commit).