CVE-2018-25368

Nord VPN 6.14.31 Denial of Service via Password Field

CVSS 8.7 HIGHEPSS 0.4%CWE-789

Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long string in the password field. Attackers can paste a buffer of repeated characters into the password input field to trigger an application crash when attempting to authenticate.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

Nordvpn · NordVPN

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/45304unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://nordvpn.com/download/https://www.exploit-db.com/exploits/45304 https://www.vulncheck.com/advisories/nord-vpn-denial-of-service-via-password-field