CVE-2020-29238
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server is running as a reverse proxy via a specially crafted request.
Risk Assessment
An attacker can remotely read confidential data processed by the router, potentially leading to leakage of network or user information.
Recommendation
Immediately update the ExpressVPN router firmware to the latest version that fixes this vulnerability and restrict access to the management interface.
Original NVD description (English source)
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.