{
  "cveId": "CVE-2024-25728",
  "url": "https://patchblox.com/security/cve/CVE-2024-25728",
  "summary": "CVE-2024-25728 is fixed in ExpressVPN on 1 platform by ExpressVPN 12.73.0.10 (version 12.73.0.10), released February 7, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ExpressVPN: Insecure Storage of Sensitive Information",
  "description": "ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user\u0027s ISP instead of to the ExpressVPN DNS servers), which may allow remote attackers to obtain sensitive information about websites visited by VPN users.",
  "published": "2024-02-11T22:15:08Z",
  "severity": "",
  "cvss": 7.5,
  "cwe": "CWE-922: Insecure Storage of Sensitive Information",
  "epss": 0.00669,
  "epssPercentile": 0.52231,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2024-25728",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "ExpressVPN",
      "fixedVersion": "12.73.0.10",
      "fix": "ExpressVPN 12.73.0.10",
      "url": "https://patchblox.com/security/fix/windows-app/expressvpn.expressvpn-12.73.0.10",
      "released": "2024-02-07T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}