CVE-2022-27599 QVR Pro Client
Local authenticated administrators can access sensitive information via log files in QVR Pro Client, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27599?
CVE-2022-27599 is a medium-severity vulnerability in QNAP Systems Inc. QVR Pro Client, published on 8 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local authenticated administrators with an additional, less-protected path to acquiring the information via unspecified vectors.
We have already fixed the vulnerability in the following version: Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Pro Client 2.3.0.0420 and later
Weakness: CWE-532
Which versions are affected by CVE-2022-27599?
It affects 1 product.
Products include Qnap Qvr Pro Client.
How do I fix CVE-2022-27599?
No fix has been published for CVE-2022-27599 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-27599 being exploited?
There is no known exploitation of CVE-2022-27599 in the wild and no public exploit code.
Sources
Also known as GHSA-qp45-7vjc-wwc4.