CVE-2023-49114

Published: Feb 26, 2024Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.

Affected (1)

Products: Hexagon: Qognify Vms Client Viewer

1 product

Qognify Vms Client Viewer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hexagon Qognify Vms Client Viewer	From 7.1

Related CWEs

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (4)

http://seclists.org/fulldisclosure/2024/Mar/10

Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

ExploitMailing ListThird Party Advisory

https://r.sec-consult.com/qognify

Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

ExploitThird Party Advisory

http://seclists.org/fulldisclosure/2024/Mar/10

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://r.sec-consult.com/qognify

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.