Named Pipe Vulnerability in iTop VPN by iTop

CVE-2022-24141

What is CVE-2022-24141?

The iTop VPN application version 3.2 contains a vulnerability in its iTopVPNmini.exe component. This flaw arises from the application's attempt to continuously connect to a named pipe server. An attacker can exploit this weakness by creating a named pipe with the same identifier, enabling them to intercept connections and leverage the ImpersonateNamedPipeClient() function to gain unauthorized access to another user's security token. This could pose significant risks to user privacy and data integrity.

References