CVE-2022-27152 - Vulnerability Details - OpenCVE

Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:A/AC:L/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Roku	Express Express 4k\+ Roku Os Roku Tv Streambar Streambar Pro Streaming Stick 4k Streaming Stick 4k\+ Ultra Wireless Speakers Wireless Subwoofer

Configuration 1 [-]

AND

cpe:2.3:o:roku:roku_os:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:roku:express:-:::::::*
	cpe:2.3:h:roku:express_4k\+:-:::::::*
	cpe:2.3:h:roku:roku_tv:-:::::::*
	cpe:2.3:h:roku:streambar:-:::::::*
	cpe:2.3:h:roku:streambar_pro:-:::::::*
	cpe:2.3:h:roku:streaming_stick_4k:-:::::::*
	cpe:2.3:h:roku:streaming_stick_4k\+:-:::::::*
	cpe:2.3:h:roku:ultra:-:::::::*
	cpe:2.3:h:roku:wireless_speakers:-:::::::*
	cpe:2.3:h:roku:wireless_subwoofer:-:::::::*

No data.

References

Link	Providers
https://github.com/llamasoft/RootMyRoku
https://support.roku.com/article/12554388937879

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-04-08T00:00:00

Updated: 2024-08-03T05:18:39.390Z

Reserved: 2022-03-14T00:00:00

Link: CVE-2022-27152

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-08T18:15:09.987

Modified: 2024-11-21T06:55:16.973

Link: CVE-2022-27152

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:roku:roku_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD2C3EBF-6FC5-4EBC-99D3-40E454B6606D", "versionEndIncluding": "9.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:roku:express:-:*:*:*:*:*:*:*", "matchCriteriaId": "0FF33B1E-AD75-46CB-9AAD-E762D7B2994D", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:express_4k\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "32F49C9D-7042-473E-88A7-6121513E92C0", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:roku_tv:-:*:*:*:*:*:*:*", "matchCriteriaId": "E683FFF5-6B1F-4847-9B50-9C17880870D2", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:streambar:-:*:*:*:*:*:*:*", "matchCriteriaId": "50520608-A2C8-4D08-971A-D608469904D3", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:streambar_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7F65E30-6D07-48E7-80DD-E8275443480C", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:streaming_stick_4k:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF338F83-6265-4774-9D0A-0F3448695179", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:streaming_stick_4k\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "57C736A0-122E-4445-8BF2-DA4EC0822575", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:ultra:-:*:*:*:*:*:*:*", "matchCriteriaId": "98F084EC-AB6A-4488-A6F2-9EAF50281F73", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:wireless_speakers:-:*:*:*:*:*:*:*", "matchCriteriaId": "8B95508E-9223-478B-A6A9-87E655DD5354", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:wireless_subwoofer:-:*:*:*:*:*:*:*", "matchCriteriaId": "9A4066B4-DDE3-4937-8B51-7DEFBF3B7D02", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification."}, {"lang": "es", "value": "Los dispositivos Roku que ejecutan RokuOS versi\u00f3n v9.4.0 build 4200 o anteriores, que usan un chip WiFi de Realtek son vulnerables a una modificaci\u00f3n arbitraria de archivos"}], "id": "CVE-2022-27152", "lastModified": "2024-11-21T06:55:16.973", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.7, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 5.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-08T18:15:09.987", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/llamasoft/RootMyRoku"}, {"source": "cve@mitre.org", "url": "https://support.roku.com/article/12554388937879"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/llamasoft/RootMyRoku"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.roku.com/article/12554388937879"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}