NordVPN for Windows contains a missing authorization check that allows a local low‑privileged attacker to act as a trusted process. By connecting to the named pipe \\.\pipe\nord-security\v1\NordVpnService\Server an attacker can invoke the ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType methods with an arbitrary service name. This ability permits stopping any unprotected Windows service and changing its startup type, effectively denying service to critical system services. The vulnerability is classified as a lack of authorization (CWE‑863).

The issue affects Nord Security’s NordVPN client for Windows on all versions prior to 8.12. The vulnerable component is the user‑mode application that communicates over a named pipe. Messages indicate that the fix was released in version 8.12, so any installation of older releases is susceptible.

The CVSS score of 6.8 signals a moderate severity. EPSS data are not available, so no exploitation probability can be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires local access with at least low‑privilege credentials, but once achieved it can stop unprotected services such as logging or monitoring goals. Because the vulnerability cannot affect Windows‑protected processes (PPL, Tamper Protection), the impact is limited to services that run as non‑protected processes, yet an attacker could still disrupt system availability.