PT-2023-5850 · Qvpn · Qvpn Device Client

Runzi Zhao · Published 2023-10-06 · Updated 2023-10-11 · CVE-2023-23371

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions QVPN Device Client versions prior to 2.2.0.0823

Description A cleartext transmission of sensitive information issue has been reported, which could allow local authenticated administrators to read sensitive data via unspecified vectors.

Recommendations For versions prior to 2.2.0.0823, update to QVPN Windows 2.2.0.0823 or later to resolve the issue.

Fix

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-310

CWE-319

CWE-311

Related Identifiers

BDU:2023-06537

CVE-2023-23371

Affected Products

Qvpn Device Client

References · 10

• https://bdu.fstec.ru/vul/2023-06537 · Security Note
• https://qnap.com/en/security-advisory/qsa-23-39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23371 · Security Note
• https://vuldb.com/ru/?id.241477 · Note
• https://t.me/cibsecurity/71746 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1710366692776231079 · Twitter Post
• https://t.me/cvenotify/59279 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023100911 · Note
• https://twitter.com/CVEnew/status/1710337331423560095 · Twitter Post