Medium severity · published Jul 6, 2022
CVE-2022-24141
The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastate_iTopVPN_Pipe_Server on a loop
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastate_iTopVPN_Pipe_Server on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient().
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IV
Itop Vpn · Iobit
3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24141
Third Party Advisory
https://github.com/tomerpeled92/CVE/
More from Itop Vpn
6.6
CVE-2022-24140
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a…
5.5
CVE-2024-1195
iTop VPN IOCTL ITopVpnCallbackProcess.sys denial of service