Qsee Client Insecure DLL Loading Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in the installer for Qsee Client versions 1.0.1 and prior, due to insecure loading of Dynamic Link Libraries (DLLs). This flaw allows arbitrary code to be executed with administrative privileges. The issue arises when a user is instructed to place a malicious DLL in the same directory as the installer and then run the installer.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution with administrative privileges.

Remediation

Qsee has stated that the product is no longer under development and recommends users discontinue its use.