Design/Logic Flaw

2023-10-0617:15:00

PRIOn knowledge base

www.prio-n.com

credentials

vulnerability

qvpn device client

local admins

user accounts

sensitive data

4.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors.

We have already fixed the vulnerability in the following version:
QVPN Windows 2.1.0.0518 and later

CPENameOperatorVersion
qvpnge2.1.0
qvpnlt2.1.0.0518

CPE	Name	Operator	Version
	qvpn	ge	2.1.0
	qvpn	lt	2.1.0.0518

References

www.qnap.com/en/security-advisory/qsa-23-36