QualitySoft QND CVE-2025-64701
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLog in to Windows as low-privilege user
-
ExploitAbuse QND improper privilege management (CWE-268)
-
ExecutionElevate to local administrator
-
ImpactAccess or alter sensitive data and run arbitrary actions
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Privilege chaining prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already be able to log in interactively to a Windows system that has QND Premium, Advance, or Standard (Ver.11.0.9i or earlier) installed, i.e. a valid low-privilege local account (CVSS PR:L, AV:L). What limits exploitation: there is no remote attack surface and no network vector, so an external unauthenticated attacker cannot use this directly - it is an escalation step usable only after local access is obtained, by a malicious insider, or chained behind another foothold. No user interaction by a victim is needed (UI:N). The specific QND component or privileged operation that is abused is not named in the available description, so the precise configuration dependency cannot be confirmed from the provided data. |
| Impact | This is a locally-exploitable privilege escalation (CVSS 4.0 base 8.5) in QND Premium/Advance/Standard, requiring an attacker to already hold a low-privilege authenticated session (CVSS AV:L/PR:L) on a Windows host running the product. The high score is driven entirely by full technical impact (VC:H/VI:H/VA:H) once triggered, not by reachability - the local attack vector and prior-login requirement make this a post-compromise or malicious-insider escalation primitive rather than a remotely wormable threat. Exploitation signals are weak and consistent: EPSS is only 0.12% (2nd percentile), the CVE is not in CISA KEV, and no public exploit was identified in the provided data. There is no SSVC decision data supplied. The signals align rather than conflict: a genuinely high-impact local EoP that is not currently being exploited at scale. Priority should be driven by whether QND is deployed on sensitive or multi-user Windows endpoints where untrusted local users exist; in single-admin or tightly-controlled deployments the real-world risk is modest. Note the input 'Microsoft' tag appears to be a vendor mislabeling - QND is a Quality Soft product that merely runs on Windows. |
| Exploit ScenarioDerived | A standard (non-administrator) user who can log in to a Windows machine where QND is installed abuses the product's improper privilege management to elevate to local administrator. From there they read or modify sensitive data and run arbitrary actions in the system's security context. No public proof-of-concept exploit is known at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Privilege escalation in QualitySoft QND Premium, Advance, and Standard (Ver.11.0.9i and earlier) on Windows allows any user who can already log in interactively to the host to obtain administrator privileges, after which sensitive information can be read or altered and arbitrary actions performed with SYSTEM-level rights. The flaw is strictly local (CVSS 4.0 base 8.5; assessed CVSS 3.1 AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H): there is no network or remote attack surface, so an external unauthenticated attacker cannot use it directly - it is an escalation step that requires an existing low-privilege local session, a malicious insider, or chaining behind another foothold. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is very low at 0.12% (2nd percentile), so near-term mass exploitation is unlikely; the practical risk concentrates on multi-user or shared Windows endpoints running QND.
RemediationAI
No vendor-released patch version is identified in the provided data, and absence of a stated fix is not confirmation that none exists - check the QualitySoft advisory at https://www.qualitysoft.com/product/qnd_vulnerabilities_2025/ (mirrored via JVN at https://jvn.jp/jp/JVN40102375/) for the current fixed build and upgrade path, then update QND Premium, Advance, or Standard on every Windows host above Ver.11.0.9i; if a fixed release is not yet listed, open a vendor support case and track the JVN note for the patch announcement. In the interim, compensating controls should target the prerequisite - local interactive logon - because the vulnerability has no remote attack surface: remove unnecessary local accounts from QND hosts, deny interactive logon rights to non-administrative staff where the QND agent does not require it (trade-off: users who must run QND client functions locally will be blocked, so scope the change to servers and shared/kiosk endpoints rather than knowledge-worker desktops), tighten membership of the local Administrators and any QND-specific service groups, and audit for unexpected privilege changes or QND service restarts that would indicate exploitation. Because escalation requires a pre-existing foothold, detection should focus on process trees where a non-privileged user spawns or triggers a QND component (including its services and scheduled tasks) that runs as SYSTEM or Administrator, and on subsequent access to sensitive local data; endpoint monitoring for such token/privilege transitions gives better coverage than network controls here, and none of these workarounds removes the underlying weakness as a patched build would.
Affected ProductsAI
QualitySoft QND Premium, QND Advance, and QND Standard on Windows, versions Ver.11.0.9i and all earlier releases, are affected; no fixed version is stated in the supplied data. No CPE identifiers were provided in the CVE record, so the vendor product names above are the definitive scope statement rather than a CPE match. The vendor advisory is published at https://www.qualitysoft.com/product/qnd_vulnerabilities_2025/ and the JVN Japan coordination note is at https://jvn.jp/jp/JVN40102375/ (reported by vultures@jpcert.or.jp). Administrators should verify their exact build number against the vendor page, since the advisory covers the 11.x line and any deployment at or below 11.0.9i should be treated as in scope.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-268, Privilege Chaining - a weakness in which one privilege level is leveraged to acquire a higher one, rather than a single memory-safety or injection bug. In practice this means a component of the QND client/server stack installed on Windows executes or is reachable in a way that lets an ordinary authenticated local user cause code to run in a more privileged security context (for example a service, helper process, or file/permission path that trusts the calling user), resulting in full administrator rights. The affected technology is QualitySoft's QND IT asset and helpdesk management suite, which is deployed as Windows agents and services on managed endpoints - a deployment model that inherently mixes low-privilege interactive users with high-privilege background components. No CPE strings were supplied with this record, so exact platform and edition CPEs could not be enumerated; the authoritative affected scope is QualitySoft's own advisory, which covers QND Premium, Advance, and Standard up to and including Ver.11.0.9i. The advisory text does not name the specific QND component, registry/file path, or privileged operation that is abused, so the precise configuration dependency (and therefore which installations are exploitable) cannot be confirmed from the available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local privilege escalation by an already-authenticated low-privilege Windows user (AV:L/PR:L), no interaction needed, yielding full admin control of the host (C/I/A:H, scope unchanged).
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
DescriptionCVE.org
QND Premium/Advance/Standard Ver.11.0.9i and prior contains a privilege escalation vulnerability, which may allow a user who can log in to a Windows system with the affected product to gain administrator privileges. As a result, sensitive information may be accessed or altered, and arbitrary actions may be performed.
Executive ViewAI
QualitySoft QND Premium, Advance, and Standard (Ver.11.0.9i and earlier) on Windows contains a high-severity local privilege escalation vulnerability that allows an existing low-privileged user to obtain administrator and SYSTEM rights, enabling sensitive data exposure or alteration. The flaw requires an authenticated local session, and no public exploit has been identified at time of analysis, so mass external attacks are unlikely; the practical exposure is concentrated on shared or multi-user Windows endpoints running QND. Leadership should care because no vendor patch is currently available, and a local user or insider could escalate to full control on affected systems.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict interactive logon to trusted users, enforce least privilege and remove unnecessary local admin rights, apply application allowlisting to limit QND execution, deploy EDR monitoring for privilege escalation, and isolate shared/multi-user QND endpoints until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB