Published:2026/03/09  Last Updated:2026/03/09

JVN#11676807
Installer for Qsee Client may insecurely load Dynamic Link Libraries

Overview

The installer for Qsee Client provided by Qsee may insecurely load Dynamic Link Libraries.

Products Affected

  • Qsee Client versions 1.0.1 and prior

Description

The installer for Qsee Client provided by Qsee contains the following vulnerability with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.

  • Uncontrolled search path element (CWE-427)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
    • CVE-2026-30896

Impact

Arbitrary code may be executed with the administrative privilege.

Solution

Stop Using the Product
The developer states that the product is no longer developed and recommends that users stop using the product.

Vendor Status

Vendor Link
Qsee Download Qsee APP

References

  1. Japan Vulnerability Notes JVNTA#91240916
    Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-30896
JVN iPedia JVNDB-2026-000035