Cloudanix VulnDB

CVE-2025-59692

Low · 3.7

CVSS

3.7

EPSS

0.2%

Published

Sep 18, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A VPN program on Linux can silently turn off your computer's protective firewall settings when you connect and never turn them back on, leaving the machine open to outside access.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
Application
Class
Misconfiguration
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The VPN client flushes existing iptables rules, applies default ACCEPT policies on connect, and fails to restore prior state on disconnect, removing protections configured by UFW, containers, or other tools.

Why it matters to the business

Organizations relying on layered host firewall policies face unintended exposure of services and increased attack surface when users connect to the affected VPN, with remediation required by the published fixed version to avoid operational risk.

How an attack unfolds

An attacker does not trigger the issue directly; instead, a user initiates a VPN connection with the vulnerable client, causing the flush of protective rules and leaving the host open to inbound traffic that was previously blocked until the client is updated or the rules are manually restored.

How to fix it

Upgrade kustomize-fips (MinimOS) to version 5.8.0-r1 or later; until then, avoid the affected PureVPN versions or manually reapply firewall rules after each disconnect and consider alternative VPN clients that preserve existing iptables state.

How to confirm the fix worked

Confirm the installed package version is at least 5.8.0-r1, then test by connecting and disconnecting the VPN while monitoring iptables-save output to verify rules persist and policies remain unchanged.

Typical attack path

  1. User launches vulnerable PureVPN CLI 2.0.1 or GUI 2.10.0 and connects to a server
  2. Client flushes iptables rules and sets ACCEPT policies
  3. Attacker sends previously blocked network traffic to exposed ports or services
  4. VPN disconnect occurs without restoring original firewall state

How to detect it

Review system logs for iptables or nftables flush commands around VPN connection timestamps, inspect /var/log/syslog or journalctl for PureVPN process activity, and compare iptables-save snapshots taken before and after VPN sessions.

What your security team should do

  • Immediately inventory all Linux systems using PureVPN CLI or GUI and block use until upgraded
  • Apply the fixed package version 5.8.0-r1 across affected MinimOS deployments
  • Implement monitoring for unexpected iptables policy changes as a compensating control

The record

PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules that may have been configured manually or by other software (e.g., UFW, container engines, or system security policies). Upon VPN disconnect, the original firewall state is not restored. As a result, the system may become unintentionally exposed to network traffic that was previously blocked. This affects CLI 2.0.1 and GUI 2.10.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities