CVE-2024-25728

—

CVSS 3.1

7.5 high

EPSS

<1%p50

Published

Feb 11, 2024 (Feb 11, 2024)

Modified

Jun 17, 2026

Description

ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user's ISP instead of to the ExpressVPN DNS servers), which may allow remote attackers to obtain sensitive information about websites visited by VPN users.

Vendors: expressvpn
Products: expressvpn
Weakness: CWE-922
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.