CVE-2022-35899

2022-07-2117:15:08

CWE-428

[email protected]

web.nvd.nist.gov

asustek

aura ready

game sdk

unquoted service path

escalation of privileges

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

15.9%

JSON

There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\ASUS\GameSDK.exe file.

Affected configurations

Nvd

Node

asusaura_ready_game_software_development_kitMatch1.0.0.4

AND

microsoftwindowsMatch-

VendorProductVersionCPE
asusaura_ready_game_software_development_kit1.0.0.4cpe:2.3:a:asus:aura_ready_game_software_development_kit:1.0.0.4:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
asus	aura_ready_game_software_development_kit	1.0.0.4	cpe:2.3:a:asus:aura_ready_game_software_development_kit:1.0.0.4:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*