Critical VPN Vulnerability: ExpressVPN Exposed IPs via RDP Misrouting

Daily Security Review

A critical vulnerability in ExpressVPN’s Windows client has put a spotlight on the often-overlooked dangers of debug code making its way into production software. This episode dives into how a debug configuration error allowed Remote Desktop Protocol (RDP) traffic to bypass the VPN tunnel, potentially exposing users’ real IP addresses and compromising their privacy. While encryption remained intact, the misrouting flaw meant anyone observing the network—such as ISPs or threat actors on shared Wi-Fi—could infer which remote servers a user was accessing via RDP.

This vulnerability, discovered by security researcher "Adam-X," affected multiple versions of the ExpressVPN client (from version 12.97 up to 12.101.0.2-beta) before a patch was issued in version 12.101.0.45. Although the issue was deemed "low risk" due to RDP’s more limited use among IT professionals and enterprise users, the implications are far-reaching. We explore how this misstep echoes a previous DNS leak caused by ExpressVPN's split tunneling feature and what it reveals about the persistent risks in VPN architecture.

We also expand the conversation to include broader software development lessons. From Common Weakness Enumerations (CWEs) like CWE-489 (Active Debug Code) and CWE-215 (Sensitive Info in Debug Code), to real-world consequences such as the infamous HP keylogging controversy, debug code remains a silent but dangerous adversary in cybersecurity. We'll cover how poor internal testing and oversight can unravel even the most privacy-focused tools—and what best practices can prevent these incidents, including zero-trust frameworks, strict tunneling policies, secure RDP configurations, and vigilant monitoring.

If you rely on a VPN for privacy, especially in corporate settings or when using remote access tools like RDP, you won’t want to miss this deep dive into one of the year’s most revealing security incidents.

#ExpressVPN #VPNLeak #RDP #DebugCode #CVE #Cybersecurity #VPNPrivacy #RemoteAccess #SplitTunneling #IPLeak #EnterpriseSecurity #ZeroTrust #NetworkSecurity #SecureVPN #PrivacyBreach #SoftwareDevelopment #SecurityPatch #CWE #ITSecurity #TechNews