A DLL hijacking vulnerability in Qsee Client 1.0.1 and prior poses a critical risk of arbitrary code execution with administrative privileges.

This vulnerability is classified as an Uncontrolled Search Path Element (CWE-427), where the installer insecurely loads Dynamic Link Libraries. An unauthenticated local attacker can place a malicious DLL in the application directory, which the installer then executes with elevated administrative rights when triggered by a user.

The exploitation of this flaw allows an attacker to achieve full control over the local system by executing code with administrative privileges. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, or the deployment of persistent malware within the organization.

Immediate Action: Since a specific patch version is currently unknown, users should immediately cease the use of the affected installer and monitor official Qsee support channels for the release of a secured version.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious file creation events in application directories and audit process execution chains for unusual DLL loading behaviors.

Compensating Controls: Deploy endpoint detection and response (EDR) solutions to flag or block the execution of unsigned or unexpected DLLs within application installation folders.

Public Exploit Available: No — there is no evidence of a weaponized exploit or public proof-of-concept in the provided data.

This vulnerability presents a significant security risk to workstations and servers where Qsee Client is deployed. Organizations should prioritize restricting local user permissions and ensuring that installers are only executed from trusted, read-only network shares to prevent the placement of malicious DLLs. Please remain vigilant for updates from the vendor to resolve this insecure search path issue permanently.