Back to Database
Status published
High
CVE-2025-54870
VTun-ng's failure to initialize encryption modules may cause reversion to plaintext
Vulnerability Description
VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling. The bug was first introduced in VTun-ng version 3.0.12. This is fixed in version 3.0.18. To workaround this issue, avoid blowfish-256.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54870
Credits & Attribution
No credits recorded in the NVD database.
Affected Vendor
leakingmemory
View all reports →Affected Software
vtun-ng
Vulnerable Versions:
>= 3.0.12, < 3.0.18
Timeline
Official Publish:
August 5th, 2025
Last Modified:
August 5th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.