Security readout for executives and security teams
Plain-English summary
CVE-2019-25572 affects NordVPN version 6.19.6. A local user can crash the application by entering an overly long value in the login email field. This is an availability issue for the VPN client, not evidence of data theft or system compromise in the provided sources.
Executive priority
Treat as a moderate endpoint availability risk. Prioritize environments where NordVPN is required for business access or installed on shared systems. There is no sourced evidence of active exploitation, but public exploit information increases the need to verify versions and follow vendor guidance.
Technical view
The issue is described as a buffer-overflow-related denial of service in NordVPN 6.19.6. The CVSS v4 vector is local, low complexity, no privileges, and high vulnerable-system availability impact. Sources identify a public ExploitDB entry, but do not show active exploitation or a confirmed fixed version.
Likely exposure
Exposure is limited to systems running NordVPN 6.19.6 where a local attacker can interact with the client login screen. Enterprise impact depends on how broadly this specific client version is deployed and whether users rely on it for business connectivity.
Exploitation context
A public exploit reference exists, but the provided sources do not indicate CISA KEV listing or active exploitation. The attack requires local interaction with the NordVPN client and appears to cause application crash rather than broader code execution or privilege escalation.
Researcher notes
Sources identify NordVPN 6.19.6 only. Patch status and affected platform scope are not fully established in the provided bundle, although references include a Windows download URL. Avoid assuming other versions are affected. The assigned CWE is CWE-1260, and the main impact is application denial of service.
Mitigation direction
- Inventory endpoints for NordVPN 6.19.6.
- Check NordVPN guidance for an updated or corrected release.
- Upgrade affected clients if vendor guidance identifies a safe version.
- Restrict local access to shared or kiosk systems running the client.
- Document compensating controls where immediate upgrade is not possible.
Validation and detection
- Confirm installed NordVPN client versions across managed endpoints.
- Review helpdesk reports for repeated NordVPN client crashes.
- Check whether affected systems require VPN availability for critical workflows.
- Monitor vendor and CVE sources for patch or advisory updates.
- Validate remediation by confirming affected version removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1260: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25572 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-46343CVE reference · exploit
- Official Product HomepageCVE reference · product
- Product ReferenceCVE reference · product
- VulnCheck Advisory: NordVPN 6.19.6 Denial of Service via Email Field Buffer OverflowCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.