Vulnerabilities > CVE-2024-25728 - Unspecified vulnerability in Expressvpn

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

expressvpn

NVD

Published: 2024-02-11

Updated: 2024-11-21

Summary

ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user's ISP instead of to the ExpressVPN DNS servers), which may allow remote attackers to obtain sensitive information about websites visited by VPN users.

Vulnerable Configurations

Part	Description	Count
Application	Expressvpn Expressvpn Expressvpn 12.23.1 Expressvpn Expressvpn 12.24.0 Expressvpn Expressvpn 12.25.1 Expressvpn Expressvpn 12.26.0 Expressvpn Expressvpn 12.27.0 Expressvpn Expressvpn 12.28.0 Expressvpn Expressvpn 12.29.0 Expressvpn Expressvpn 12.31.0 Expressvpn Expressvpn 12.32.0 Expressvpn Expressvpn 12.54.0 Expressvpn Expressvpn 12.56.0 Expressvpn Expressvpn 12.58.0 Expressvpn Expressvpn 12.59.0 Expressvpn Expressvpn 12.63.0 Expressvpn Expressvpn 12.64.0 Expressvpn Expressvpn 12.65.0 Expressvpn Expressvpn 12.66.0 Expressvpn Expressvpn 12.67.0 Expressvpn Expressvpn 12.68.0 Expressvpn Expressvpn 12.69.0 Expressvpn Expressvpn 12.70.0 Expressvpn Expressvpn 12.71.0 Expressvpn Expressvpn 12.72.0	23

Summary

Vulnerable Configurations

References