title: QVPN Device Client
description: An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors.
We have already fixed the vulnerability in the following version:
QVPN Windows 2.1.0.0518 and later
problem types: CWE-522
affected:
{
defaultStatus: unaffected
product: QVPN Windows
vendor: QNAP Systems Inc.
versions:
lessThan: 2.1.0.0518, status: affected, version: 2.1.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: We have already fixed the vulnerability in the following version:
QVPN Windows 2.1.0.0518 and later
