CVE-2024-25728

High

ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends…

mitre·NVD-CWE-noinfo·Published 2024-02-11

CVSS

7.5

EPSS

0.01

KEV

Exploits

cve.orgen

330 chars

ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user's ISP instead of to the ExpressVPN DNS servers), which may allow remote attackers to obtain sensitive information about websites visited by VPN users.

NVDen

330 chars

NVDes

385 chars

ExpressVPN anterior a 12.73.0 en Windows, cuando se utiliza túnel dividido, envía solicitudes DNS de acuerdo con la configuración de Windows (por ejemplo, las envía a servidores DNS operados por el ISP del usuario en lugar de a los servidores DNS de ExpressVPN), lo que puede permitir a atacantes remotos obtener información confidencial sobre sitios web visitados por usuarios de VPN.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	cve.org	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N