CVE-2018-3952

PoC —

CVSS 3.1

8.8 high

EPSS

<1%p56

Published

Sep 7, 2018 (Sep 7, 2018)

Modified

Jun 17, 2026

Description

An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially crafted configuration file can cause a privilege escalation, resulting in the execution of arbitrary commands with system privileges.

Vendors: nordvpn
Products: nordvpn
Weakness: CWE-78
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news2 stories

Personal VPN and Its Evasions: Risk Factors and How to Maintain Network Visibility

Palo Alto Unit 42Jun 6, 12:16 UTC · Jun 6, 2024Vulnerability CVE-2020-15590 CVE-2019-12579 CVE-2019-12578+23 CVEs

Vulnerability Spotlight: CVE-2018-3952 / CVE-2018-4010 - Multi-provider VPN Client Privilege Escalation Vulnerabilities

Cisco TalosSep 7, 12:44 UTC · Sep 7, 2018Vulnerability in the wildCVE-2018-3952 CVE-2018-4010 CVE-2018-10169