PT-2022-24534 · Asus · Armoury Crate Service

Published 2022-09-28 · Updated 2022-09-30 · CVE-2022-38699

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Armoury Crate Service (affected versions not specified)

Description The issue concerns Armoury Crate Service's logging function, which lacks sufficient validation to check if the log file is a symbolic link. This allows a physical attacker with general user privilege to modify the log file property to a symbolic link, pointing to an arbitrary system file. As a result, the logging function can overwrite the system file, disrupting the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2022-38699

Affected Products

Armoury Crate Service

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-38699 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38699 · Vendor Advisory
• https://twcert.org.tw/tw/cp-132-6522-4eacb-1.html · Note