What is CVE-2022-38699?

CVE-2022-38699 is a medium-severity vulnerability in Asus Armoury Crate Service, classified under Improper Link Resolution Before File Access. CVSS score: 5.9/10. Published 2022-09-28.

How severe is CVE-2022-38699?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Asus Armoury Crate Service

CVE-2022-38699

Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.

EPSS: 0.003 (23.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

Affected products

Asus Armoury Crate Service — versions 5.1.5.0
Asus Armoury_crate_service

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

References

twcert@cert.org.tw (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-38699?: CVE-2022-38699 is a medium-severity vulnerability in Asus Armoury Crate Service, classified under Improper Link Resolution Before File Access. CVSS score: 5.9/10. Published 2022-09-28.
How severe is CVE-2022-38699?: Medium severity. CVSS v3 base score is 5.9 out of 10.