CVE-2023-49114

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
Qognify	VMS Client Viewer	>=7.1
qognify	vms_client_viewer	<= 7.1

References

http://seclists.org/fulldisclosure/2024/Mar/10Exploit, Mailing List, Third Party Advisory
https://r.sec-consult.com/qognifyExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2024/Mar/10Exploit, Mailing List, Third Party Advisory
https://r.sec-consult.com/qognifyExploit, Third Party Advisory

Timeline

Published: Feb 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-491157.5MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.CVE-2023-491175.4PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arb CVE-2023-491185.5in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read.CVE-2023-491195.4Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an CVE-2023-49126.5An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16 CVE-2023-491217.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-b CVE-2023-491227.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-b CVE-2023-491237.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-b CVE-2023-491247.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of boun CVE-2023-491257.8A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.263), Parasolid V35.1 (All versions < V35.1.252), Parasolid V36 CVE-2023-491267.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of boun CVE-2023-491277.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of boun