Read our full analysis of the vulnerability and its potential exploitation here: blog.amberwolf.com/blog/2025/ju...

These core dumps may contain sensitive data and compromise the integrity of ThinOS’s storage encryption, directly contradicting Dell’s documentation, which states that all partitions except the boot partition are encrypted.

If the device configuration allows it, this option can be accessed by unauthenticated users. In addition, previously generated core dumps may be accessible to unauthenticated attackers.

You can read our latest blog at blog.amberwolf.com/blog/2025/ja...

CVE-2024-5921 is a Remote Code Execution and Privilege Escalation vulnerability in Palo Alto Global Protect, which is also exploitable using NachoVPN. Our full technical write up is available here: blog.amberwolf.com/blog/2024/no...

CVE-2024-29014 is an RCE as SYSTEM vulnerability in SonicWall NetExtender that is exploitable using NachoVPN. Full technical details of the vulnerability are available in out blog: blog.amberwolf.com/blog/2024/no...

You can get the code, the prebuilt container or contribute modules on GitHub: github.com/AmberWolfCyb...

NachoVPN is a modular server that allows for the automatic exploitation of VPN clients when they connect. It currently supports Cisco AnyConnect, SonicWall NetExtender, Palo Alto GlobalProtect and Pulse/Ivanti Connect Secure) across a multiple platforms. blog.amberwolf.com/blog/2024/no...