CVE-2022-22988 HIGH

CVE-2022-22988: Insecure file and directory permissions on EdgeRover

Vendor Western Digital
Product EdgeRover
Weakness CWE-275
Published January 13, 2022
Last update August 3, 2024

CVSS base score

7.7/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to get authenticated access to the device.

Key dates

02Disclosure timeline

January 13, 2022 CVE published
August 3, 2024 Record updated