CVE-2025-59692 Misconfiguration in PureVPN
PureVPN Linux client flushes existing firewall rules and fails to restore them, potentially exposing the system to unauthorized network traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59692?
CVE-2025-59692 is a low-severity vulnerability in PureVPN, published on 18 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules that may have been configured manually or by other software (e.g., UFW, container engines, or system security policies). Upon VPN disconnect, the original firewall state is not restored. As a result, the system may become unintentionally exposed to network traffic that was previously blocked. This affects CLI 2.0.1 and GUI 2.10.0.
Weakness: CWE-669
Which versions are affected by CVE-2025-59692?
How do I fix CVE-2025-59692?
No fix published yet.
Is CVE-2025-59692 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59692 exists.
Sources
Also known as GHSA-f3jf-wgcf-hqjr, ROOT-OS-UBUNTU-2204-CVE-2025-59692.