JVN#95825631
Multiple vulnerabilities in QND

Overview

QND provided by QualitySoft Corporation contains multiple vulnerabilities.

Products Affected

• QND Premium Ver.11.1i and earlier
• QND Standard Ver.11.1i and earlier
• QND Advance Ver.11.0.9i and earlier

Description

QND Standard/Premium provided by QualitySoft Corporation contains multiple vulnerabilities listed below:

• Use of hard-coded cryptographic key (CWE-321)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 6.8
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Base Score 5.5
  • CVE-2026-81326
• Improper access control on a named pipe (CWE-782)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.7
  • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.8
  • CVE-2026-84408

Impact

• An attacker who can log in to a Windows PC where the affected product's client is installed may obtain an administrator's ID and password (CVE-2026-81326).
• An attacker who can log in to a Windows PC where the affected product's client is installed may execute an arbitrary command with SYSTEM privileges (CVE-2026-84408).

Solution

Update the software and Apply the patch
Apply the patch after updating to Ver.11.0.9i or Ver.11.1i according to the information provided by the developer.