PT-2022-23006 · Asustek · Asustek Aura Ready Game Sdk

Angelo Pio Amirante · Published 2022-07-20 · Updated 2022-10-06 · CVE-2022-35899

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASUSTeK Aura Ready Game SDK service (GameSDK.exe) version 1.0.0.4

Description The issue is related to an unquoted service path in the ASUSTeK Aura Ready Game SDK service. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%ASUSGameSDK.exe file.

Recommendations For version 1.0.0.4, consider quoting the service path to prevent potential privilege escalation. As a temporary workaround, restrict access to the GameSDK.exe service until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2022-35899

Affected Products

Asustek Aura Ready Game Sdk

References · 8

• 🔥 https://exploit-db.com/exploits/50985 · Exploit
• 🔥 https://packetstormsecurity.com/files/167763/Asus-GameSDK-1.0.0.4-Unquoted-Service-Path.html · Exploit
• 🔥 https://github.com/AngeloPioAmirante/CVE-2022-35899 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35899 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35899 · Vendor Advisory
• https://t.me/cibsecurity/46761 · Telegram Post
• https://t.me/cvenotify/34053 · Telegram Post
• https://t.me/defcon_news/101720 · Telegram Post