Login Sign Up

CVE-2021-29978

9.8 CRITICAL

📋 TL;DR

CVE-2021-29978 involves multiple security vulnerabilities in Mozilla VPN versions before 2.3 that were discovered during a third-party security audit. While described as 'low security issues' in the description, the CVSS score of 9.8 suggests critical impact potential. Users of Mozilla VPN versions below 2.3 are affected.

💻 Affected Systems

Products:
  • Mozilla VPN
Versions: Versions < 2.3
Operating Systems: Windows, macOS, Linux, Android, iOS
Default Config Vulnerable: ⚠️ Yes
Notes: All platforms running vulnerable Mozilla VPN versions are affected. The specific vulnerabilities are documented across multiple GitHub issues.

📦 What is this software?

Mozilla Vpn by Mozilla

View all CVEs affecting Mozilla Vpn →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise, credential theft, or unauthorized access to VPN-protected traffic and network resources.

🟠

Likely Case

Information disclosure, privilege escalation, or VPN connection manipulation leading to traffic interception.

🟢

If Mitigated

Limited impact with proper network segmentation and defense-in-depth controls, though VPN functionality could still be disrupted.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

No public exploit code available. The vulnerabilities were discovered during a security audit and fixed before widespread exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.3 and later

Vendor Advisory: https://github.com/mozilla-mobile/mozilla-vpn-client/issues/797

Restart Required: Yes

Instructions:

1. Open Mozilla VPN application. 2. Check for updates in settings. 3. Install version 2.3 or later. 4. Restart the VPN client. 5. Verify the update completed successfully.

🔧 Temporary Workarounds

Disable Mozilla VPN

all

Temporarily disable or uninstall Mozilla VPN until patched

sudo systemctl stop mozilla-vpn (Linux)
Uninstall via Control Panel (Windows)
Move to Applications Trash (macOS)

Use alternative VPN

all

Switch to a different VPN provider temporarily

🧯 If You Can't Patch

  • Disconnect affected systems from sensitive networks
  • Implement network monitoring for unusual VPN traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check Mozilla VPN version in application settings or about section

Check Version:

mozilla-vpn --version (Linux) or check About in application menu

Verify Fix Applied:

Confirm version is 2.3 or higher in application settings

📡 Detection & Monitoring

Log Indicators:

  • Unusual VPN connection attempts
  • VPN service crashes or restarts
  • Authentication failures in VPN logs

Network Indicators:

  • Unexpected VPN tunnel establishment
  • Traffic bypassing VPN tunnel
  • Unusual ports or protocols from VPN client

SIEM Query:

source="mozilla-vpn" AND (event_type="error" OR event_type="failure")

📊 Metadata

CVE ID: CVE-2021-29978
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: August 5, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON