EUVD-2026-80227
GHSA-4388-7v5g-7q9g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local logon required (AV:L, PR:L); no complexity in exploiting an open named pipe (AC:L); executing as SYSTEM from user context is a scope change (S:C) with full CIA impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
7DescriptionCVE.org
QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges.
AnalysisAI
Local privilege escalation in Qualitysoft Corporation's QND endpoint management client for Windows (Advance ≤Ver.11.0.9i, Premium and Standard ≤Ver.11.1i) allows any logged-in user to execute arbitrary commands with SYSTEM privileges by abusing an improperly access-controlled named pipe exposed by the client component. The named pipe lacks a restrictive DACL, permitting user-mode processes running under low-privileged accounts to communicate with the SYSTEM-level pipe server and direct it to execute attacker-controlled commands. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid interactive logon session (local or via RDP/terminal services) on a Windows PC where the QND client - in any of the Advance, Premium, or Standard editions at an affected version - is installed and its pipe server is running; (2) no additional Windows privileges beyond a standard unprivileged user account, since the pipe lacks DACL restrictions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 score of 8.7 overstates network reachability: the provided vector carries AV:N (Network), which directly contradicts the description's explicit requirement that the attacker be 'logged in to a Windows PC where the affected product's client is installed' - the realistic attack vector is AV:L (Local), not network-reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the QND client to a version above the confirmed affected ceiling: QND Advance to a release above Ver.11.0.9i, and QND Premium or Standard to a release above Ver.11.1i. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows systems running affected QND versions and establish incident response protocols. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today