CVE-2022-22988: western digital edgerover Permission Issues
Vulnerability summary
CVE-2022-22988 is a critical (CVSS 9.1) Permission Issues vulnerability in western digital edgerover. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.8% of scored vulnerabilities.
Timeline
- 13-01-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to get authenticated access to the device.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA7.7HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
0.00 pp
From 0.71% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-275Permission IssuesWeaknesses in this category are related to improper assignment or handling of permissions.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Western digital1 product
- edgerover≥ EdgeRover Mac Desktop App, < 1.5.0-576 | ≥ EdgeRover Windows Desktop App, < 1.5.0-576
Westerndigital1 product
- edgerover< 1.5.0-576
2 vendors · 2 products
References
1 links- www.westerndigital.com/support/product-security/wdc-22003-edgerover-desktop-app-version-1-5-0-576X Refsource MISCVendor Advisory