Description
QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password.
Published: 2026-09-16
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Obtaining administrator credentials on a local Windows machine
Action: Assess Impact
AI Analysis

Impact

QND uses a hard‑coded cryptographic key. A user who is logged into a Windows PC where the client is installed can use that key to derive administrator credentials, such as an ID and password. This weakness is a form of in‑source cryptographic key storage (CWE‑321).

Affected Systems

The vulnerability affects QualitySoft Corporation’s QND Advance, QND Premium, and QND Standard products. No specific versions are listed, so any installed client should be considered at risk.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity and the EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local on a Windows PC, where an attacker must already be logged in. If successful, the attacker can obtain administrator credentials.

Generated by OpenCVE AI on September 18, 2026 at 12:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a vendor‑provided update that removes the hard‑coded key if one is available.
  • If no patch is available, restrict the client’s installation to trusted users and disable or remove local accounts with administrative privileges on the client machine.
  • Enable additional security controls such as Windows Credential Guard or enforce multi‑factor authentication for administrative accounts to mitigate the impact of any credential compromise.

Generated by OpenCVE AI on September 18, 2026 at 12:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Qualitysoft
Qualitysoft qnd Advance
Qualitysoft qnd Premium
Qualitysoft qnd Standard
Vendors & Products Qualitysoft
Qualitysoft qnd Advance
Qualitysoft qnd Premium
Qualitysoft qnd Standard

Fri, 18 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Title Hard‑coded Cryptographic Key Enables Local Credential Theft

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Title Hard‑coded Cryptographic Key Enables Local Credential Theft

Wed, 16 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password.
Weaknesses CWE-321
References
Metrics cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Qualitysoft Qnd Advance Qnd Premium Qnd Standard
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-09-16T14:57:07.233Z

Reserved: 2026-09-10T06:51:56.086Z

Link: CVE-2026-81326

cve-icon Vulnrichment

Updated: 2026-09-16T14:57:04.011Z

cve-icon NVD

Status : Deferred

Published: 2026-09-16T08:16:39.917

Modified: 2026-09-16T19:27:25.623

Link: CVE-2026-81326

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T21:52:00Z

Weaknesses
  • CWE-321

    Use of Hard-coded Cryptographic Key