Adding "capabilities" of "CAP_SYS_ADMIN" for openvpn and the sudo mount is likely the security risk implied.
As an alternate solution, consider reviewing the man pages for fstab and filesystem mount *options*
Many filesystems includes mount options of "noauto" and "user".
The "noauto" option means it is not mounted automatically on boot.
The "user" option allows non-root users to mount filesystems explicitly listed in the /etc/fstab
With these options in supported filesystems as options in fstab, you should not need to sudo, just the "mount" call.
Example entry in /etc/fstab to try:
//xxxyyy.selfhost.eu/nas-media /home/shares/nas-media cifs user=xx,password=xx,port=12345,noauto,user 0 0
Then try removing the sudo command from your script, and instead replace this:
/usr/bin/sudo /bin/mount -t cifs -v -o user=xx,password=xx,port=12345 //xxxyyy.selfhost.eu/nas-media /home/shares/nas-media \
>>/etc/openvpn/log.txt 2>>/etc/openvpn/log.txt
with:
/bin/mount /home/shares/nas-media
since mount will lookup the entry for how to mount "/home/shares/nas-media" and use the options specified.
Having a password for your network mount in your script or fstab is yet another security problem. (If this is a single-user system, it is not as bad as with a multi-user system, but leaving a password in-the-plain in a script or config file is pretty risky -- any change in ownership of your machine means the "evil user" also has access to your password and share and if they get your vpn private key, maybe even your access to the vpn.) An alternate to putting them in globally readable /etc/fstab is through using the cifs mount option "credentials=" which allows you to specify a file which contains credentials needed for mounting (see the man page) and then add access restrictions to who can read from that file.
If the mount is supposed to be read-only or read-write? Specify explicitly with "ro" or "rw" on the options field explicitly.
Also, it would probably be good to specify a "uid=" (in fstab for this mount) for mounting and file operations locally, too, to specify a UserID to mount for access and DAC (Discretionary Access Controls). If this is a single-user system, then have the uid=YOURUSERID so you can access files on that share as "you" no matter who tried to mount it and users that are not "you" (except root) on your box would not have access to those network files.
