## Summary
QND Windows client (QualitySoft) contains an improper access control flaw on a named pipe that can allow a local attacker who is logged in to execute arbitrary commands with SYSTEM privileges. The affected versions include QND Premium Ver.11.1i and earlier, QND Standard Ver.11.1i and earlier, and QND Advance Ver.11.0.9i and earlier.
## Technical Details
- Vulnerability: Improper access control on a named pipe (CWE-782) leading to SYSTEM-privileged command execution (CVE-2026-84408).
- Preconditions (from vendor advisory): an attacker must be able to log in to a Windows PC where the QND Windows client is installed.
- Attack outcome (from NVD/vendor text): the attacker may execute an arbitrary command with SYSTEM privileges.
- Related issue in the same advisory: CVE-2026-81326 (hard-coded cryptographic key) can enable theft of an administrator ID/password, which may further facilitate privileged access.
## Affected
- QND Premium Ver.11.1i and earlier
- QND Standard Ver.11.1i and earlier
- QND Advance Ver.11.0.9i and earlier
- Component: Windows client
## Impact
- Local attacker with a valid login can achieve arbitrary command execution as SYSTEM.
- Potential privilege escalation and full compromise of the affected Windows host.
## Mitigation
1. Update QND Windows client to a fixed version: apply the vendor patch after updating to Ver.11.0.9i or Ver.11.1i (per product line guidance).
2. Apply the patch provided via the customer portal (vendor states a修正プログラム is provided there).
3. Reduce exposure by limiting local logon capability on endpoints where QND client is installed (since exploitation requires an authenticated local user session).
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-782