Cloudanix VulnDB

CVE-2025-59691

Low · 3.7

CVSS

3.7

EPSS

0.2%

Published

Sep 18, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A VPN program on Linux computers can stop hiding your real internet address after certain network changes, letting websites or attackers see where you really are.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes IPv6 packets to bypass the VPN tunnel interface on Linux after network events such as Wi-Fi reconnect or system resume; the client reports a connected state while IPv6 traffic uses the native interface, exposing the real IPv6 address.

Why it matters to the business

Users lose expected privacy protections, allowing external observers to obtain their actual location or identity and undermining the value of the VPN service for anonymous or protected access.

How an attack unfolds

An attacker waits for or triggers a network event that causes the VPN to reconnect, then queries external IPv6-enabled services or inspects traffic to capture the leaked real IPv6 address that is no longer routed through the tunnel.

How to fix it

Upgrade the PureVPN CLI client beyond version 2.0.1 and GUI client beyond version 2.10.0 once corrected releases are available. As an interim measure, disable IPv6 system-wide or configure firewall rules to drop IPv6 traffic when the VPN is active.

How to confirm the fix worked

After applying updates, reproduce network events while the VPN is connected and verify that IPv6 address checks on external test sites return only tunnel addresses with no native IPv6 leakage.

Typical attack path

  1. Trigger or observe a network event such as Wi-Fi reconnect or system resume
  2. Confirm the VPN client reports a connected state without enforcing IPv6 routing
  3. Send probes or observe traffic to external IPv6 endpoints to record the exposed real address

How to detect it

Review VPN client logs for reconnection events after suspend or Wi-Fi changes, then correlate with outbound IPv6 connections that originate from the physical interface rather than the tunnel; inspect packet captures or netfilter logs for IPv6 traffic bypassing the VPN device.

What your security team should do

  • Track PureVPN release announcements for corrected Linux client builds
  • Temporarily disable IPv6 on managed Linux endpoints using the affected clients
  • Evaluate alternative VPN solutions that include verified IPv6 leak protection testing

The record

PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or system resume. In the CLI client, the VPN auto-reconnects and claims to be connected, but IPv6 traffic is no longer routed or blocked. In the GUI client, the IPv6 connection remains functional after disconnection until the user clicks Reconnect. In both cases, the real IPv6 address is exposed to external services, violating user privacy and defeating the advertised IPv6 leak protection. This affects CLI 2.0.1 and GUI 2.10.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities