CVE-2023-23371: qnap systems inc. qvpn windows Missing Encryption of Sensitive Data
Vulnerability summary
CVE-2023-23371 is a medium (CVSS 5.2) Missing Encryption of Sensitive Data vulnerability in qnap systems inc. qvpn windows. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.2% of scored vulnerabilities.
Timeline
- 06-10-2023PublishedVulnerability first disclosed.
- 19-09-2024Last modifiedVulnerability information updated.
Description
A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.2.0.0823 and later
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
0.00 pp
From 0.11% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Affected systems
Qnap1 product
- qvpn≥ 2.2.0, < 2.2.0.0823
Qnap systems inc.1 product
- qvpn windows≥ 2.2.x, < 2.2.0.0823
2 vendors · 2 products
References
1 links- www.qnap.com/en/security-advisory/qsa-23-39Vendor Advisory