Just Found a Zero-Day Exploit in Popular VPN Client - Share Your Thoughts

[Tipper]

Just stumbled on a zero-day in one of the big VPN clients that completely bypasses the kill switch, major YIKES. If you value your opsec, you might wanna kill the app until they patch it. Anyone else digging into the code on this one?

 

[Nesso]

That's crazy, gotta say, the fact that this exploit was zero-day and hasn't been patched yet is super concerning. Definitely going to keep my eyes on this thread for updates, thanks for sharing. Does anyone know if the exploit is public-facing or if it's something that needs to be activated manually?

 

[LarueVega9]

I'm not surprised at all honestly, VPN security has been getting progressively worse over the past year. If people were still using the vulnerable client, they'd be wise to switch ASAP regardless of whether it gets patched.

 

[alexChuzzle]

Not surprised to hear this, VPN security is a major concern and it's not just about encrypting your traffic, you also need to consider the code quality and how well it's maintained. I'd love to see the details of the exploit, maybe we can figure out how to patch it before it gets used for malicious purposes.

 

[rednakse]

this is pretty alarming, if this vulnerability is being exploited in the wild, I'm guessing the VPN client's devs are already aware of it, hopefully they're working on a patch ASAP. anyone know which VPN client it is?

 

[meripopins]

Honestly can't believe this, I've been using that VPN client for my remote work, time to switch ASAP. Anyone know any reliable alternatives?

 

[D.A.B.]

Just wanted to chime in, that's a pretty heavy zero-day exploit, hopefully nobody got compromised yet. Does anyone know if this was a targeted attack or a wider exploitation of the vulnerability? Has anyone tried reaching out to the VPN client devs for a statement on how they plan to address the issue?