CVE-2022-34866

2022-07-2006:15:28

jpcert

www.cve.org

passage drive

box version

data verification

interprocess communication

arbitrary os command

localsystem privilege

windows system

EPSS

Percentile

12.6%

JSON

Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running.

CNA Affected

[
  {
    "product": "Passage Drive",
    "vendor": "Yokogawa Rental & Lease Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN23766146/index.html

www.yrl.com/fwp_support/info/a1hrbt0000002037.html

EPSS

Percentile

12.6%

JSON

Related for CVELIST:CVE-2022-34866