CVE-2022-42455
High
Description
ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges.
SeverityHigh
CVSS7.8
Exploit probability—
ProductAsus Armoury Crate
PublishedFeb 15, 2023
First seenFeb 15, 2023
Weakness typeCWE-269Improper privilege management
How to fix
Update
- asus armoury_crate5.3.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asus armoury_crate | v < 5.3.4.1 | 5.3.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.