PT-2022-1880 · Edgerover · Edgerover

Published 2022-01-13 · Updated 2026-02-24 · CVE-2022-22988

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EdgeRover versions prior to 1.5.1-594

Description The issue is related to insufficient permission assignment checks for a critical resource in the EdgeRover application, which can be exploited by a remote attacker to elevate privileges or cause a denial of service. The vulnerability can only be exploited once an attacker has already gained authenticated access to the device. It is associated with incorrect handling of file and directory permissions, allowing an attacker to traverse through files and directories. The estimated severity of this issue is high, and it has been identified as a critical vulnerability.

Recommendations For EdgeRover versions prior to 1.5.1-594, update to version 1.5.1-594 or newer to resolve the issue. As a temporary workaround, consider restricting access to the EdgeRover application until the update is applied. Additionally, using the default file manager provided with the operating system can help mitigate the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-275

CWE-732

Related Identifiers

BDU:2022-01385

CVE-2022-22988

Affected Products

Edgerover

References · 7

• https://westerndigital.com/support/product-security/wdc-22003-edgerover-desktop-app-version-1-5-0-576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22988 · Security Note
• https://bdu.fstec.ru/vul/2022-01385 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22988 · Vendor Advisory
• https://t.me/nekaspersky/2021 · Telegram Post
• https://t.me/cveNotify/153055 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022031801 · Note