← CVE Intelligence

CVE-2022-38699

ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw PUBLISHED

Description (CNA)

Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.

Affected (CNA)

Vendor / productVersions
ASUS / Armoury Crate Serviceaffected 5.1.5.0

CWE

CWE-59

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.