by Kastro
Paper/Archive/CVE-2022-22988

CVE-2022-22988

Western Digital EdgeRover — Insecure file and directory permissions on EdgeRover

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 53.7.537 × 2010.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to get authenticated access to the device.

Affected

ProductAffectedFixed inSource
EdgeRoverEdgeRover Mac Desktop App – < 1.5.0-5761.5.0-576CNA
EdgeRoverEdgeRover Windows Desktop App – < 1.5.0-5761.5.0-576CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
WDC PSIRT (CNA)7.7CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refwesterndigital.com/support/product-security/wdc-22003-edgerover-desktop-app-version-1-5-0-576