ExpressVPN patches Windows bug that exposed remote desktop traffic

ExpressVPN released a patch for its Windows app, version 12.101.0.45, to fix a vulnerability exposing remote desktop traffic. An independent researcher, Adam-X, discovered the flaw through their bug bounty program and reported it. The vulnerability left TCP port 3389, often used by RDP, unprotected due to accidentally shipped debug code. Exploitation was deemed unlikely as a hacker needed specific conditions, including a crafted web request. The potential impact was limited to revealing the target's real IP address, not the transmitted data. ExpressVPN acted swiftly, releasing the patch within five days of the report. The company is implementing automated tests to prevent future accidental inclusion of debug code. This proactive response, along with a recent privacy audit, demonstrates ExpressVPN's commitment to security. Users of ExpressVPN on Windows are urged to update to the latest version immediately. The fix prevents potential exposure of IP addresses when using RDP.