What is CVE-2022-1824?

CVE-2022-1824 is a high-severity vulnerability in Mcafee Consumer Product Removal Tool, classified under Uncontrolled Search Path Element. CVSS score: 7.9/10. Published 2022-06-20.

How severe is CVE-2022-1824?

High severity. CVSS v3 base score is 7.9 out of 10.

Is CVE-2022-1824 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mcafee Consumer Product Removal Tool

CVE-2022-1824

An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee.

EPSS: 0.003 (27.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.9 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H.

Affected products

Mcafee Consumer_product_removal_tool
Mcafee,llc Mcafee Consumer Product Removal Tool — versions unspecified

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

Public proof-of-concept exploits

References

trellixpsirt@trellix.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2022-1824?: CVE-2022-1824 is a high-severity vulnerability in Mcafee Consumer Product Removal Tool, classified under Uncontrolled Search Path Element. CVSS score: 7.9/10. Published 2022-06-20.
How severe is CVE-2022-1824?: High severity. CVSS v3 base score is 7.9 out of 10.
Is CVE-2022-1824 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.