CVE-2022-24141: Iobit Itop VPN

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastate_iTopVPN_Pipe_Server on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient().

Affected products

• Iobit Itop VPN: version 3.2 only

Published 2022-07-06. Last modified 2026-07-09.