CVE-2020-36992: NordVPN Privilege Escalation Vulnerability

CVE-2020-36992 Overview

CVE-2020-36992 is an unquoted service path vulnerability in NordVPN version 6.31.13.0 that affects the nordvpn-service component. This privilege escalation vulnerability allows local attackers to execute arbitrary code with elevated LocalSystem permissions by exploiting how Windows handles unquoted service paths during system startup or reboot sequences.

Critical Impact

Local attackers can achieve privilege escalation to LocalSystem permissions, potentially gaining complete control over the affected system through the unquoted service path in nordvpn-service.

Affected Products

• NordVPN 6.31.13.0
• NordVPN Windows Client (nordvpn-service component)

Discovery Timeline

• 2026-01-28 - CVE CVE-2020-36992 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2020-36992

Vulnerability Analysis

This vulnerability falls under CWE-428 (Unquoted Search Path or Element), a well-known class of Windows privilege escalation vulnerabilities. When a Windows service executable path contains spaces and is not enclosed in quotation marks, Windows will attempt to locate and execute binaries at each space-delimited portion of the path.

The nordvpn-service in NordVPN 6.31.13.0 registers with an unquoted binary path. During service startup—whether at system boot, manual restart, or after a reboot—Windows parses this unquoted path and attempts to execute potential binaries at intermediate path locations before reaching the intended executable.

An attacker with local access and write permissions to strategic directories along the service path can plant a malicious executable. When the service starts, Windows may execute this malicious binary instead of the legitimate NordVPN service, granting the attacker LocalSystem privileges—the highest privilege level on Windows systems.

Root Cause

The root cause is the improper registration of the NordVPN service executable path without proper quotation marks. When the service path includes spaces (common in paths like C:\Program Files\NordVPN\...), Windows' CreateProcess API interprets each space as a potential path delimiter, creating the opportunity for binary planting attacks.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access to the target system. The attacker must be able to write to a directory that precedes the actual service binary in the unquoted path hierarchy. Typical exploitation scenarios include:

The attacker identifies the unquoted service path through service enumeration tools or registry inspection. They then create a malicious executable named to match an intermediate path segment (such as Program.exe in the root of C:\). Upon the next service startup or system reboot, Windows attempts to execute the planted binary with LocalSystem privileges, achieving privilege escalation.

This type of vulnerability is particularly dangerous in environments where users have write access to directories like C:\ or non-standard installation paths, and in scenarios where system administrators restart services or reboot machines as part of routine maintenance.

Detection Methods for CVE-2020-36992

Indicators of Compromise

• Unexpected executables appearing in C:\, C:\Program.exe, or similar intermediate path locations
• Unusual process execution chains originating from service startup events
• Service creation or modification events involving the nordvpn-service with suspicious binary paths
• Anomalous LocalSystem-level process activity following system reboots

Detection Strategies

• Monitor Windows Event Logs for Service Control Manager events (Event ID 7045, 7036) involving nordvpn-service
• Use endpoint detection tools to identify binaries in unusual locations that execute with SYSTEM privileges
• Implement file integrity monitoring for root directories and Program Files paths
• Query the Windows registry for unquoted service paths using automated vulnerability scanners

Monitoring Recommendations

• Enable detailed process creation auditing (Event ID 4688) with command-line logging
• Deploy SentinelOne's behavioral AI to detect suspicious privilege escalation patterns during service startup sequences
• Establish baselines for normal service execution patterns and alert on deviations
• Monitor for new executable files created in system root directories

How to Mitigate CVE-2020-36992

Immediate Actions Required

• Upgrade NordVPN to the latest available version that addresses the unquoted service path
• Audit the NordVPN service registration to verify the binary path is properly quoted
• Restrict write permissions on directories in the service path to administrative users only
• Review systems for any suspicious executables that may have been planted for exploitation

Patch Information

NordVPN users should update to the latest version of the NordVPN client. Verify the service path is correctly quoted after updating by checking the Windows Services console or querying the registry. For additional details, refer to the VulnCheck Security Advisory and Exploit-DB #48790 for technical context.

Workarounds

• Manually quote the service path in the registry at HKLM\SYSTEM\CurrentControlSet\Services\nordvpn-service by adding quotation marks around the ImagePath value
• Remove write permissions from the C:\ root directory and intermediate path directories for non-administrative users
• Consider using application whitelisting to prevent unauthorized binaries from executing in sensitive directories
• Implement least-privilege principles to minimize the impact of potential exploitation

# Verify and fix unquoted service path via command line
# Check current path (PowerShell as Administrator)
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\nordvpn-service" -Name ImagePath

# Manually quote the path if unquoted (replace with actual path)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\nordvpn-service" -Name ImagePath -Value '"C:\Program Files\NordVPN\nordvpn-service.exe"'