CyberGhost 评测

nothing has come to our attention that causes us to believe that CyberGhost’s configuration of IT systems and management of the supporting IT operations as of October 31st, 2025, were not prepared, in all material respects,

The procedures we performed do not provide any assurance about “CyberGhost’s No-logs Policy” for any other period.

The full assurance report is available for download, so that anyone can read the findings in full.

Deloitte Audit S.R.L. conducted an audit to check that our VPN servers are in compliance with our privacy policy. To view the report, please agree to the disclaimer below.

Because of the extensive nature of the audit and the scope of Deloitte services, excerpts from the report cannot be shared directly.

CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "CG6Service" service.

CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.

After a successful logout, user credentials remain in memory while the process is still open, and can be obtained by dumping the process memory and parsing it.

CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks.

CyberGhost for Windows suffers from a `SYSTEM` privilege escalation vulnerability through the `CG6Service` service.

A specially crafted JSON payload sent to the CyberGhost RPC service can lead to command line injection when the OpenVPN process is launched, leading to full system compromise.

The latest 8.3.10.10015 version released on the 24 February 2023 fixes this issue.

We are sorry that you have had this experience with us on Bugcrowd

In an independent test of the Windows client, it was found that the client retains login credentials in memory until restart, even after the user has logged out.

2024/02/01 vendor responded, stating that attackers with local access are outside of application's threat model

2024/03/13 status changed to resolved

All VPN servers run on a RAM disk leveraging full disk encryption. Once a VPN server loses power, all data associated with it is immediately lost.

Inspection of relevant IT systems (VPN servers, distribution servers, etc.) and verification of their configuration against the description provided

By running its VPN service on RAM-only servers, the company can ensure that all server data is immediately deleted with every reboot.

Crossrider said on Tuesday it has acquired cyber security software-as-a service (SaaS) provider Romanian company CyberGhost for a total of 9.2 million euro

Kape used to be known as Crossrider until it changed its name in 2018 to move away from its advert-slinging past and reinvent itself as a cybersecurity outfit.

Kape now owns VPN services CyberGhost VPN as well as ZenMate and Private Internet Access, and with ExpressVPN onboard

CyberGhost has been part of Kape Technologies (LSE:KAPE) since 2017.

In practical terms, the company stopped its browser SDK business to focus on the VPN sector, purchasing CyberGhost VPN in 2017.

Kape Technologies plc (formerly Crossrider Ltd.) is a British-Israeli information security company owned by businessman Teddy Sagi.

its board had accepted an offer of £2.85 per share from Unikmind. Israeli businessman Sagi already owns a 55% stake in Kape.

Unikmind intends to pass a written resolution in the near future which will result in Kape making an application to the London Stock Exchange for the cancellation of the admission to trading of Kape shares on AIM.