Vulnerability · Published Dec 19, 2024 · Assigned by qnap
CVE-2022-27595QVPN Device Client
High 7.8
In plain English
A high-severity uncontrolled search path in QVPN Windows from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QVPN Windows 2.0.0.1316 and later QVPN Windows 2.0.0.1310 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | QVPN Windows | 2.0.x – before 2.0.0.13162.0.x – before 2.0.0.1310 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H