high7.5Public exploit code
CVE-2020-29238
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server runnin…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow2021-04-13 · webapps · multiple
Impact
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Expressvpn | Expressvpn | Version 1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://ja1sharma.com/blog/2021/CVE-2020-29238/
- http://packetstormsecurity.com/files/162152/ExpressVPN-VPN-Router-1.0-Integer-Overflow.html
- https://bugcrowd.com/disclosures/4e8d5325-8e49-4ea3-962a-a088bbb73a3f/expressvpn-router-integer-buffer-overflow-server-info-disclosure-when-router-s-nginx-server-used-as-reverse-proxy-server
- http://ja1sharma.com/blog/2021/CVE-2020-29238/
- http://packetstormsecurity.com/files/162152/ExpressVPN-VPN-Router-1.0-Integer-Overflow.html
- https://bugcrowd.com/disclosures/4e8d5325-8e49-4ea3-962a-a088bbb73a3f/expressvpn-router-integer-buffer-overflow-server-info-disclosure-when-router-s-nginx-server-used-as-reverse-proxy-server