PT-2023-5851 · Qvpn · Qvpn Device Client+1

Runzi Zhao · Published 2023-10-06 · Updated 2023-10-11 · CVE-2023-23370

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions QVPN Device Client versions prior to 2.1.0.0518

Description The issue is related to insufficient protection of credentials, which could allow local authenticated administrators to gain access to user accounts and sensitive data via unspecified vectors.

Recommendations For versions prior to 2.1.0.0518, update to QVPN Windows 2.1.0.0518 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until the update is applied.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2023-06538

CVE-2023-23370

Affected Products

Qvpn Device Client

Qvpn Windows

References · 10

• https://qnap.com/en/security-advisory/qsa-23-36 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23370 · Security Note
• https://bdu.fstec.ru/vul/2023-06538 · Security Note
• https://t.me/cvenotify/59084 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1710365426989879784 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023100912 · Note
• https://t.me/cibsecurity/71738 · Telegram Post
• https://vuldb.com/ru/?id.241476 · Note
• https://twitter.com/CVEnew/status/1710337332493070448 · Twitter Post