CVE-2020-36992
Published: 28 January 2026
Summary
CVE-2020-36992 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Nordvpn (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2020-36992 is an unquoted service path vulnerability in Nord VPN version 6.31.13.0, specifically affecting the nordvpn-service component. Published on 2026-01-28, this issue (CWE-428) stems from an unquoted binary path that enables local attackers to execute arbitrary code with elevated privileges, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit the vulnerability during system startup or reboot by placing a malicious executable in a directory that precedes the legitimate service binary in the system's search path. Successful exploitation allows the attacker to run code with LocalSystem permissions, granting high-impact access to confidentiality, integrity, and availability.
Advisories and related resources, including those from VulnCheck at https://www.vulncheck.com/advisories/nord-vpn-nordvpn-service-unquoted-service-path, an exploit proof-of-concept on Exploit-DB at https://www.exploit-db.com/exploits/48790, and NordVPN's site at https://nordvpn.com, provide further details on the issue and potential mitigations such as updating to a patched version.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30900
Vulnerability details
Nord VPN 6.31.13.0 contains an unquoted service path vulnerability in its nordvpn-service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path during system startup or reboot to potentially run malicious code with…
more
LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path exploitation for local privilege escalation via path interception on Windows service startup.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path vulnerability by identifying, testing, and installing vendor patches such as the updated NordVPN version.
Enforces secure configuration settings for services, including properly quoted executable paths to prevent local attackers from hijacking the nordvpn-service binary path.
Implements deny-by-default software execution restrictions that block the malicious executable placed by attackers in the system search path ahead of the legitimate service binary.