CVE-2022-22262CWE-59

ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access

High · published March 1, 2022

CVSS v3.1
7.7
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic link to system file path, to delete arbitrary system files and disrupt system service.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2022-03-01T01:55Z
EPSS history
Timeline
  • 01 MAR 01:55Z
    ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access
    cvelistv5