Skip to main content

Top VPN services found to have had major security flaws

(Image credit: Image Credit: Flickr / Mike MacKenzie)

Two major Virtual Private Networks (VPN) providers have had flaws in their services which enabled hackers and other malicious actors from executing arbitrary code. This was confirmed by security researchers from Cisco Talos recently, who said ProtonVPN and NordVPN placed their users at significant risk.

The security flaws, which were named CVE-2018-3952 and CVE-2018-4010, were present on Windows machines until recently, when they were patched.

However, even with the patches, Talos' researchers claim code can still be executed, through a system admin account.  The patches were released this April.

NordVPN issued a second, final patch this August, while ProtonVPN took a bit more time and finally patched things up earlier this month. Security researchers advise all ProtonVPN and NordVPN users to patch their clients up as soon as possible, to avoid any potential risk.

A ProtonVPN spokesperson told ZDNet that the final patch was automatically sent to all users.

"Later versions of ProtonVPN have resolved this issue and users have been automatically prompted to update. We have not seen any evidence of this being exploited in the wild, as a user's computer needs to first be compromised by a hacker before this bug can be exploited. The fix we have implemented should eliminate all bugs of this nature. We continue to work with independent security researchers around the globe to make ProtonVPN more secure through our bug bounty program."

12.9. Edit:

Following the release of this article, a NordVPN spokesperson Laura Tyrell reached out for further clarification. She said that the issues were patched before they were publicly disclosed, and that the hacker needed physical access to the victim's PC in order for this to work.

 “The vulnerability had already been fixed by the time Cisco publicly disclosed the CVE. At the beginning of August, an automatic update was pushed to all our customers, which means the majority of users had their apps updated long before the public disclosure. These actions virtually eliminated any risk of the vulnerability being exploited in real life conditions," Tyrell said.

"It is also worth mentioning, that in order to exploit the flaw, an attacker had to have physical access to a victim's PC. Such a situation alone leads to a variety of severe security threats beyond any individual apps.”

NordVPN has released a blog post with more details which you can find here.

If you're interested in learning more about Virtual Private Networks, make sure to read our VPN guide for businesses

Image Credit: Flickr / Mike MacKenzie