CVE-2018-25368

HIGH

Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long string in the password field. Attackers ...

Affects 1 product across 1 vendor.

CVSS 3.17.5
CVSS v48.7
EPSS0.4%
Percentile31th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-789: CWE-789
◆ AI Analysis — automated analysis, not human-reviewed

A high severity vulnerability (CVE-2018-25368) affects the target system. Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long string in the password field. Attackers can paste a buffer of repeated characters into the pa...

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-25368?
A high severity vulnerability (CVE-2018-25368) affects the target system. Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long string in the password field. Attackers can paste a buffer of repeated characters into the pa...
What is the CVSS score for CVE-2018-25368?
CVE-2018-25368 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS: 0.4%.
Is CVE-2018-25368 actively exploited?
No confirmed active exploitation of CVE-2018-25368 as of 2026-10-07.
How do I remediate CVE-2018-25368?
Apply vendor patches for CVE-2018-25368. Monitor Nordvpn advisories.
What systems are affected by CVE-2018-25368?
CVE-2018-25368 affects Nordvpn Nordvpn.
Vulnerability Details
CVE IDCVE-2018-25368
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published2026-05-25
Last Modified2026-10-06
ICS Relevance0%
Weakness (CWE)
CWE-789
SourceNVD
Official Description

Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long string in the password field. Attackers can paste a buffer of repeated characters into the password input field to trigger an application crash when attempting to authenticate.

Source: NIST NVD / MITRE CVE Database

Affected Products
VendorProductAffected Versions
Nordvpn Nordvpn ≤ 6.14.31
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 143 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
Related CVEs affecting Nordvpn
CVE-2018-10170 9.8 NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulne... CVE-2018-9105 8.8 NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerabili... CVE-2018-3952 8.8 An exploitable code execution vulnerability exists in the connect functionali... CVE-2020-36992 7.8 Nord VPN 6.31.13.0 contains an unquoted service path vulnerability in its nor... CVE-2019-25572 5.5 NordVPN 6.19.6 contains a denial of service vulnerability that allows local a...
View all Nordvpn CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →