PT-2021-11660 · Expressvpn · Expressvpn Router

Ja1Sh · Published 2021-03-10 · Updated 2022-07-22 · CVE-2020-29238

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ExpressVPN Router version 1

Description: An integer buffer overflow in the Nginx webserver allows remote attackers to obtain sensitive information when the server is running as a reverse proxy via specially crafted requests.

Recommendations: For ExpressVPN Router version 1, update to a version that fixes the integer buffer overflow issue in the Nginx webserver. As a temporary workaround, consider restricting access to the reverse proxy functionality until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2020-29238

Affected Products

Expressvpn Router

References · 9

• 🔥 https://exploit-db.com/exploits/49760 · Exploit
• https://osv.dev/vulnerability/CVE-2020-29238 · Vendor Advisory
• http://expressvpn.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29238 · Security Note
• https://bugcrowd.com/disclosures/4e8d5325-8e49-4ea3-962a-a088bbb73a3f/expressvpn-router-integer-buffer-overflow-server-info-disclosure-when-router-s-nginx-server-used-as-reverse-proxy-server · Note
• http://packetstormsecurity.com/files/162152/ExpressVPN-VPN-Router-1.0-Integer-Overflow.html · Note
• https://t.me/cvenotify/11060 · Telegram Post
• https://t.me/cibsecurity/24669 · Telegram Post
• http://ja1sharma.com/blog/2021/CVE-2020-29238 · Note