What’s Vulnerable › Vulnerabilities

CVE-2023-23370: QVPN Device Client

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-06 · updated 2026-06-17
• Weakness: CWE-522

Description

An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.1.0.0518 and later

Affected products

• QNAP Systems Inc. QVPN Windows: from 2.1.0 before 2.1.0.0518 — fixed in 2.1.0.0518

How to fix

Upgrade to a fixed version: QNAP Systems Inc. QVPN Windows 2.1.0.0518. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/en/security-advisory/qsa-23-36
• https://www.qnap.com/en/security-advisory/qsa-23-36

Get alerted when CVE-2023-23370 or the next vulnerability affects your stack