CVE-2022-48226

EUVD-2022-50935
An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During installation, an EXE gets executed out of C:\Windows\Temp. A standard user can create the path file ahead of time and obtain elevated code execution. Permissions need to be modified to prevent manipulation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
8.4 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 9%
Affected Products (NVD)
VendorProductVersion
gbgplcacuant_acufill_sdk
𝑥
< 10.22.02.03
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://acuant.com
https://hackandpwn.com/disclosures/CVE-2022-48226.pdf
https://acuant.com
https://hackandpwn.com/disclosures/CVE-2022-48226.pdf