CVE-2008-2747: No-IP Dynamic Update Client

Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days.

No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values.

Affected products

• No-IP Dynamic Update Client: version 2.2.1 only

Published 2008-06-18. Last modified 2026-06-16.