Nordvpn
Monthly
Incorrect authorization in the NordVPN for Windows client before version 8.12 lets a low-privileged local user impersonate a trusted process and drive privileged service-control operations through the named pipe \\.\pipe\nord-security\v1\NordVpnService\Server. By invoking the ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType methods with an arbitrary service name, the attacker can halt unprotected Windows services and reset their startup type to Manual, producing denial of service against critical system components. Exploitation requires an existing local foothold on a host where NordVPN is installed and running - it cannot be triggered remotely - and is bounded because services protected by Windows (PPL processes and Tamper Protection, such as Windows Defender) are not affected; the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H with a supplied CVSS 4.0 base of 6.8 (MEDIUM), and no CISA KEV listing or public exploit code has been identified at time of analysis.
Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long string in the password field. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect authorization in the NordVPN for Windows client before version 8.12 lets a low-privileged local user impersonate a trusted process and drive privileged service-control operations through the named pipe \\.\pipe\nord-security\v1\NordVpnService\Server. By invoking the ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType methods with an arbitrary service name, the attacker can halt unprotected Windows services and reset their startup type to Manual, producing denial of service against critical system components. Exploitation requires an existing local foothold on a host where NordVPN is installed and running - it cannot be triggered remotely - and is bounded because services protected by Windows (PPL processes and Tamper Protection, such as Windows Defender) are not affected; the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H with a supplied CVSS 4.0 base of 6.8 (MEDIUM), and no CISA KEV listing or public exploit code has been identified at time of analysis.
Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long string in the password field. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.