Lucene search

QnapCVELIST:CVE-2023-23370

HistoryOct 06, 2023 - 4:35 p.m.

CVE-2023-23370 QVPN Device Client

2023-10-0616:35:48

CWE-522

qnap

www.cve.org

qvpn device client

insufficiently protected

credentials vulnerability

local authenticated administrators

user accounts

sensitive data

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors.

We have already fixed the vulnerability in the following version:
QVPN Windows 2.1.0.0518 and later

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "QVPN Windows",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.0.0518",
        "status": "affected",
        "version": "2.1.x",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-23-36

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2023-23370