CVE-2018-9105
NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible f...
Affects 1 product across 1 vendor.
Software does not prove or insufficiently proves that the user is who they claim to be.
Show all 10
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
This vulnerability was disclosed in 2018. A high severity vulnerability affects Nordvpn systems (CVE-2018-9105). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
BSID: BS-2018-GLOBAL-131960-H • Model: rule-based-v1 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2018-9105?
What is the CVSS score for CVE-2018-9105?
Is CVE-2018-9105 actively exploited?
How do I remediate CVE-2018-9105?
What systems are affected by CVE-2018-9105?
| CVE ID | CVE-2018-9105 |
|---|---|
| BSID | BS-2018-GLOBAL-131960-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Published | 2018-03-27 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately this XPC service is not protected, which allows arbitrary applications to connect and send it XPC messages. An attacker can send a crafted XPC message to the privileged helper tool requesting it make a new OpenVPN connection. Because he or she controls the contents of the XPC message, the attacker can specify the location of the openvpn executable, which could point to something malicious they control located on disk. Without validation of the openvpn executable, this will give the attacker code execution in the context of the privileged helper tool.
Source: NIST NVD / MITRE CVE Database
Vulnerability details: NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately this XPC service is not protected, which allows arbitrary applications to connect and send it XPC messages. An attacker can send a crafted XPC message to the privileged helper tool requesting it make a CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Exploitation Likelihood: MINIMAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Nordvpn | Nordvpn | 3.3.10 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | rule-based-v1 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | fb6d73b41832fba286440b6617e8c08624a5bb463d6bd42bfc1f7a24874ed665c0b573414c84624efbfc7847cf858bc14b09c1b53b435bee3a4598e6609b8982 |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →