CVE-2023-49114
Local Privilege Escalation via DLL Hijacking
- State
- Published
- Severity
- 6.7 Medium
- Published
- Feb 26, 2024
- Updated
- Feb 13, 2025
- Reserved
- Nov 22, 2023
Description
A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.7 Medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-427 Uncontrolled Search Path Element
Affected Products
| Product | Versions |
|---|---|
VMS Client ViewerQognify |
|
References
- https://r.sec-consult.com/qognifythird-party-advisory
- http://seclists.org/fulldisclosure/2024/Mar/10
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.