What is CVE-2022-26669?

CVE-2022-26669 is a high-severity vulnerability in Asus Control Center, classified under SQL Injection. CVSS score: 8.8/10. Published 2022-06-20.

How severe is CVE-2022-26669?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in Asus Control Center

CVE-2022-26669

ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data.

Vulnerability class: SQL Injection

EPSS: 0.010 (59.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Asus Control Center — versions 1.4.2.5
Asus Control_center — versions 1.4.2.5

Weakness classification (CWE)

CWE-89 — SQL Injection

References

twcert@cert.org.tw (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-26669?: CVE-2022-26669 is a high-severity vulnerability in Asus Control Center, classified under SQL Injection. CVSS score: 8.8/10. Published 2022-06-20.
How severe is CVE-2022-26669?: High severity. CVSS v3 base score is 8.8 out of 10.