PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules that may have been configured manually or by other software (e.g., UFW, container engines, or system security policies). Upon VPN disconnect, the original firewall state is not restored. As a result, the system may become unintentionally exposed to network traffic that was previously blocked. This affects CLI 2.0.1 and GUI 2.10.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://anagogistis.com/posts/purevpn-ipv6-leak/ |
|
History
Thu, 18 Sep 2025 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules that may have been configured manually or by other software (e.g., UFW, container engines, or system security policies). Upon VPN disconnect, the original firewall state is not restored. As a result, the system may become unintentionally exposed to network traffic that was previously blocked. This affects CLI 2.0.1 and GUI 2.10.0. | |
| Weaknesses | CWE-669 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-09-18T23:01:42.176Z
Reserved: 2025-09-18T00:00:00.000Z
Link: CVE-2025-59692
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-09-18T23:15:34.517
Modified: 2025-09-18T23:15:34.517
Link: CVE-2025-59692
Redhat
No data.
OpenCVE Enrichment
No data.