Insufficient Credentials in QVPN Windows 2.1.0.0518 Local Admin Exploit
CVE-2023-23370 Published on October 6, 2023

QVPN Device Client
An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.1.0.0518 and later

NVD

Vulnerability Analysis

CVE-2023-23370 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.


Products Associated with CVE-2023-23370

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-23370 are published in QNAP Qvpn:

QNAP Qvpn
 

Affected Versions

QNAP Systems Inc. QVPN Windows:

Exploit Probability

EPSS
0.02%
Percentile
6.11%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.