CVE-2022-36439
First published: Tue Oct 18 2022(Updated: )
AsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the Temp directory and delete another more privileged file via SYSTEM privileges. This affects ASUS System Control Interface 3 before 3.1.5.0, AsusSoftwareManger.exe before 1.0.53.0, and AsusLiveUpdate.dll before 1.0.45.0.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Asus Asusliveupdate | <1.0.45.0 | |
| Asus Asussoftwaremanger | <1.0.53.0 | |
| ASUS System Control Interface | >=3.0.0.0<3.1.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://asus-my.sharepoint.com/personal/carinacw_li_asus_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcarinacw%5Fli%5Fasus%5Fcom%2FDocuments%2FSecurity%2FCase%2D220713%2FAsus%20Arbitary%20File%20Deletion%2Epdf&parent=%2Fpersonal%2Fcarinacw%5Fli%5Fasus%5Fcom%2FDocuments%2FSecurity%2FCase%2D220713&ga=1
- https://asus.com
- https://asus-my.sharepoint.com/personal/carinacw_li_asus_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcarinacw_li_asus_com%2FDocuments%2FSecurity%2FCase-220713%2FAsus%20Arbitary%20File%20Deletion.pdf&parent=%2Fpersonal%2Fcarinacw_li_asus_com%2FDocuments%2FSecurity%2FCase-220713&ga=1
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-36439.
What is the severity of CVE-2022-36439?
The severity of CVE-2022-36439 is medium (CVSS score 6).
Which software versions are affected by CVE-2022-36439?
Asus Asusliveupdate 1.0.45.0, Asus Asussoftwaremanger 1.0.53.0, and ASUS System Control Interface 3 before 3.1.5.0 are affected by CVE-2022-36439.
How can a local user exploit CVE-2022-36439?
A local user can exploit CVE-2022-36439 by writing into the Temp directory and deleting another more privileged file via SYSTEM privileges.
Is there a fix available for CVE-2022-36439?
Yes, a fix is available for CVE-2022-36439. Please refer to the official ASUS website for the latest security updates.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/asus
- canonical/asus asusliveupdate
- canonical/asus asussoftwaremanger
- canonical/asus system control interface
- version/asus system control interface/3.0.0.0