VPN vulnerability