CVE-2023-49114 Local Privilege Escalation via DLL Hijacking
Local attackers can execute arbitrary code and gain higher privileges via DLL hijacking in Qognify VMS Client Viewer under specific conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-49114?
CVE-2023-49114 is a medium-severity vulnerability in Qognify VMS Client Viewer, published on 26 Feb 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.
Weakness: CWE-427
Which versions are affected by CVE-2023-49114?
It affects 1 product.
Products include Hexagon Qognify Vms Client Viewer.
How do I fix CVE-2023-49114?
No fix has been published for CVE-2023-49114 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-49114 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49114 exists.
Sources
Also known as GHSA-m3q9-44rg-xw34.