CVE-2022-28339: Trend Micro HouseCall for Home Networks Uncontrolled Search Path Element Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro HouseCall for Home Networks. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the log4j scanner. The process loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of an administrator.
Other sources
Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated privileges.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28339?
CVE-2022-28339 has been classified with a severity rating that suggests significant risk due to potential privilege escalation.
How do I fix CVE-2022-28339?
To remediate CVE-2022-28339, ensure that Trend Micro HouseCall for Home Networks is updated to the latest version provided by the vendor.
Who is affected by CVE-2022-28339?
CVE-2022-28339 affects installations of Trend Micro HouseCall for Home Networks that are vulnerable to local privilege escalation.
What type of attack does CVE-2022-28339 facilitate?
CVE-2022-28339 allows local attackers to escalate privileges, gaining higher access levels on the affected system.
What conditions are required to exploit CVE-2022-28339?
An attacker must first execute low-privileged code on the target system to exploit CVE-2022-28339.