CVE-2018-25241

VPN Browser+ 1.1.0.0 Denial of Service

CVSS 8.7 HIGHEPSS 0.4%CWE-306

VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of characters into the search bar to trigger an unhandled exception that terminates the application.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

VPNBrowser · VPN Browser+

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/46198unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.exploit-db.com/exploits/46198 https://www.microsoft.com/store/productId/9NFFFFS5Z2C7 https://www.vulncheck.com/advisories/vpn-browser-denial-of-service