CVE-2020-29238

CVE-2020-29238 describes an integer buffer overflow vulnerability in the Nginx webserver of ExpressVPN Router version 1. This flaw allows remote attackers to obtain sensitive information when the router operates as a reverse proxy, triggered by a specially crafted request. The vulnerability carries a high CVSS score of 7.5, indicating a critical risk due to its network-based attack vector, low attack complexity, and high confidentiality impact without requiring user interaction. While not listed in CISA's KEV catalog, an exploit (EDB-49760) is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.