PT-2023-3970 · Unknown · Qvpn Device Client

Runzi Zhao · Published 2023-07-31 · Updated 2024-12-24 · CVE-2022-27595

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QVPN Device Client versions prior to 2.0.0.1310 QVPN Device Client versions prior to 2.0.0.1316

Description The issue is related to an insecure library loading vulnerability. If exploited, it could allow local attackers who have gained user access to execute unauthorized code or commands.

Recommendations For QVPN Device Client versions prior to 2.0.0.1310, update to version 2.0.0.1310 or later. For QVPN Device Client versions prior to 2.0.0.1316, update to version 2.0.0.1316 or later.

Fix

RCE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-20

CWE-427

Related Identifiers

BDU:2023-04266

CVE-2022-27595

Affected Products

Qvpn Device Client

References · 10

• https://qnap.com/en/security-advisory/qsa-23-04 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27595 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04266 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27595 · Security Note
• https://t.me/pentestingnews/38115 · Telegram Post
• https://t.me/cvenotify/104855 · Telegram Post
• https://qnap.com/en/security-advisory/QSA-23-04 · Note
• https://t.me/cvedetector/13303 · Telegram Post
• https://twitter.com/cracbot/status/1871435691323961822 · Twitter Post
• https://twitter.com/CVEnew/status/1869573121742704651 · Twitter Post