Multiple versions of GlobalProtect-openconnect are affected by incorrect access control in GPService through DBUS GUI. The way GlobalProtect-Openconnect is set up enables arbitrary users to start a VPN connection to arbitrary servers. By hosting an openconnect compatible server the attack can redirect the entire host's traffic via their own server.