CVE-2019-25572

MEDIUM

NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste...

Affects 1 product across 1 vendor.

CVSS 3.15.5
CVSS v46.9
EPSS0.2%
Percentile4th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-1260: CWE-1260
Related Attack Patterns (CAPEC)
CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections
via CWE-1260
CAPEC-456 Infected Memory
via CWE-1260

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

NordVPN 6.19.6 is vulnerable to a denial of service attack where a local attacker can crash the application by submitting an excessively long string in the email input field during login.

BSID: BS-2026-GLOBAL-138718-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-25572?
NordVPN 6.19.6 is vulnerable to a denial of service attack where a local attacker can crash the application by submitting an excessively long string in the email input field during login.
What is the CVSS score for CVE-2019-25572?
CVE-2019-25572 has CVSS 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS: 0.2%.
Is CVE-2019-25572 actively exploited?
No confirmed active exploitation of CVE-2019-25572 as of 2026-10-09.
How do I remediate CVE-2019-25572?
Priority: MEDIUM.
What systems are affected by CVE-2019-25572?
CVE-2019-25572 affects Nordvpn Nordvpn.
Vulnerability Details
CVE IDCVE-2019-25572
BSIDBS-2026-GLOBAL-138718-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published2026-03-21
Last Modified2026-10-07
ICS Relevance0%
Weakness (CWE)
CWE-1260
SourceNVD
Official Description

NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during login to trigger an application crash.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is triggered by submitting a buffer of 100,000 characters into the email field during the login process, causing the application to crash.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Nordvpn Nordvpn ≤ 6.19.6
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 208 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashfdfd1557de0af659123d9b995a60ee152bd570d3f2c04adc2414840d46539fefc39a0726835092188fda3b2628ea0153c55e526bcad3ee47ad22f09c1f3ea028
Related CVEs affecting Nordvpn
CVE-2018-10170 9.8 NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulne... CVE-2018-9105 8.8 NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerabili... CVE-2018-3952 8.8 An exploitable code execution vulnerability exists in the connect functionali... CVE-2020-36992 7.8 Nord VPN 6.31.13.0 contains an unquoted service path vulnerability in its nor... CVE-2018-25368 7.5 Nord VPN 6.14.31 contains a denial of service vulnerability that allows unaut...
View all Nordvpn CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →