Vulnerability in Qnap Qvpn
CVE-2023-23370
An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.1.0.0518 and later
EPSS: 0.002 (5.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Qnap Qvpn
- Qnap Systems Inc. Qvpn Windows — versions 2.1.x
Weakness classification (CWE)
References
- security@qnapsecurity.com.tw (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-23370?
- CVE-2023-23370 is a medium-severity vulnerability in Qnap Qvpn, classified under Insufficiently Protected Credentials. CVSS score: 6.7/10. Published 2023-10-06.
- How severe is CVE-2023-23370?
- Medium severity. CVSS v3 base score is 6.7 out of 10.