PT-2023-3970 · Unknown · Qvpn Device Client

Runzi Zhao · Publicado 2023-07-31 · Atualizado 2024-12-24 · CVE-2022-27595

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QVPN Device Client versions prior to 2.0.0.1310 QVPN Device Client versions prior to 2.0.0.1316

Description The issue is related to an insecure library loading vulnerability. If exploited, it could allow local attackers who have gained user access to execute unauthorized code or commands.

Recommendations For QVPN Device Client versions prior to 2.0.0.1310, update to version 2.0.0.1310 or later. For QVPN Device Client versions prior to 2.0.0.1316, update to version 2.0.0.1316 or later.

Correção

RCE

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-20

CWE-427

Identificadores relacionados

BDU:2023-04266

CVE-2022-27595

Produtos afetados

Qvpn Device Client

Referências · 10

• https://qnap.com/en/security-advisory/qsa-23-04 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-27595 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04266 · Nota de Segurança
• https://t.me/pentestingnews/38115 · Publicação no Telegram
• https://t.me/cvenotify/104855 · Publicação no Telegram
• https://qnap.com/en/security-advisory/QSA-23-04 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-27595 · Nota de Segurança
• https://t.me/cvedetector/13303 · Publicação no Telegram
• https://twitter.com/cracbot/status/1871435691323961822 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1869573121742704651 · Publicação no Twitter