What is CVE-2022-36439?

CVE-2022-36439 is a medium-severity vulnerability in Asus Asusliveupdate, classified under Incorrect Default Permissions. CVSS score: 6.0/10. Published 2022-10-18.

How severe is CVE-2022-36439?

Medium severity. CVSS v3 base score is 6.0 out of 10.

Vulnerability in Asus Asusliveupdate

CVE-2022-36439

AsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the Temp directory and delete another more privileged file via SYSTEM privileges. This affects ASUS System Control Interface 3 before 3.1.5.0, AsusSoftwareManger.exe before 1.0.53.0, and AsusLiveUpdate.dll before 1.0.45.0.

EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

References

cve@mitre.org (Vendor Advisory)
cve@mitre.org

Frequently asked questions

What is CVE-2022-36439?: CVE-2022-36439 is a medium-severity vulnerability in Asus Asusliveupdate, classified under Incorrect Default Permissions. CVSS score: 6.0/10. Published 2022-10-18.
How severe is CVE-2022-36439?: Medium severity. CVSS v3 base score is 6.0 out of 10.